ZDI-26-292: QNAP TS-453E QVRPro excpostgres Exposed Dangerous Method Remote Code Execution Vulnerability

Published Apr 15, 2026

Updated

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of QNAP TS-453E devices. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-22898.

Affected Software

2 affected components

QNAP TS-453E

QNAP QVR Pro

Event History

Apr 15, 2026

Advisory Published

via ZDI·05:00 AM

Data Sourced

via ZDI·05:00 AM

Description

Frequently Asked Questions

What is the severity of ZDI-26-292?

The severity of ZDI-26-292 is critical due to its ability to allow remote code execution without authentication.

How do I fix ZDI-26-292?

To fix ZDI-26-292, update your QNAP TS-453E and QVR Pro to the latest firmware version released by QNAP.

Who is affected by the ZDI-26-292 vulnerability?

The ZDI-26-292 vulnerability affects users of QNAP TS-453E and QVR Pro devices.

Can ZDI-26-292 be exploited remotely?

Yes, ZDI-26-292 can be exploited by network-adjacent attackers, allowing for remote execution of arbitrary code.

Is authentication required to exploit ZDI-26-292?

No, authentication is not required to exploit the ZDI-26-292 vulnerability.