CVE-2026-34006: Pre-Authentication Multiple Critical Vulnerabilities in QNAP sMedioDTCPServer

Q: Which deployments need to be updated?

Systems running sMedio DTCP MOVE before version 1.4.5 are affected. The issue is fixed in sMedio DTCP MOVE 1.4.5 and later.

Q: Does exploitation require an authenticated account?

No. The reported issue is a missing authentication vulnerability, so a remote attacker may be able to exploit it without prior authentication.

Q: What could successful exploitation allow?

Successful exploitation could allow a remote attacker to gain access to the affected system.

Published Oct 15, 2026

Updated

A missing authentication for critical function vulnerability has been reported to affect sMedio DTCP MOVE. If exploited, the vulnerability could allow remote attackers to gain access to the system.

We have already fixed the vulnerability in the following version: sMedio DTCP MOVE 1.4.5 and later

Affected Software

1 affected component

sMedio DTCP MOVE<1.4.5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade QNAP sMedio DTCP MOVE to a version that resolves this vulnerability.
Fixed in 1.4.5

Event History

Oct 15, 2026

CVE Published

via MITRE·09:30 AM

Data Sourced

via MITRE·09:30 AM

RemedyDescriptionWeakness

Frequently Asked Questions

Which deployments need to be updated?

Systems running sMedio DTCP MOVE before version 1.4.5 are affected. The issue is fixed in sMedio DTCP MOVE 1.4.5 and later.

Does exploitation require an authenticated account?

No. The reported issue is a missing authentication vulnerability, so a remote attacker may be able to exploit it without prior authentication.

What could successful exploitation allow?