CVE Intelligence
Analysis AI-assisted

CVE-2026-22900: QNAP QuNetSwitch hard-coded credentials vulnerability

QNAP has reported a hard-coded credentials weakness (CWE-798) in QuNetSwitch that, according to the vendor description, can let remote attackers gain unauthorized access. The vendor states the issue is fixed in version 2.0.5.0906 and later. The record shows no confirmed exploitation, and the CISA KEV catalog does not list this CVE.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-22900 affects QNAP QuNetSwitch and is classified as a use of hard-coded credentials weakness (CWE-798). The vendor description states that remote attackers could exploit it to gain unauthorized access. The vendor has published a security advisory and fixed the issue.

Impact

  • The described impact is unauthorized access to the affected product.
  • NVD assigns a base score of 9.8 (critical). The QNAP CNA assigns a score of 6.8.
  • SSVC data in the record rates the issue as automatable (yes) with partial technical impact.

Affected products and versions

  • The record lists two product names: Qnap Qunetswitch and QNAP Systems Inc. QuNetSwitch.
  • The listed ranges are from 2.0.1.13077 up to but not including 2.0.5.0906, and from 2.0.x up to but not including 2.0.5.0906.
  • The vendor states the issue is fixed in 2.0.5.0906 and later.

Exploitation status

The CISA KEV catalog does not list this CVE in the record, and no confirmed exploitation appears in the sources consulted. The EPSS probability is 0.00332 (percentile 0.25255), and the SSVC exploitation value is none.

Remediation and mitigation

  • Update QuNetSwitch to version 2.0.5.0906 or later, as the vendor advises.
  • Build an inventory of QuNetSwitch deployments and confirm the installed version before and after the update.
  • Because the credentials are hard-coded, administrators cannot simply rotate them. Until the update is applied, restrict network access to the product to trusted hosts and networks.

Detection guidance

  • Review access logs for logins or sessions from unexpected sources or at unusual times.
  • Look for administrative or configuration changes that were not planned.

Limitations of the available information

  • The record does not list which builds between 2.0.1.13077 and 2.0.5.0906 are affected, so the affected range should be confirmed with the vendor advisory.
  • The structured fixes field is empty; the fixed version comes from the vendor description.
  • The EPSS date in the record is later than the publication date, so the EPSS values should be treated with caution.
  • Specific technical details of the weakness are not included in the record.

Frequently asked questions

Is CVE-2026-22900 being actively exploited?

The CISA KEV catalog does not list this CVE in the record, and no confirmed exploitation appears in the sources consulted. The SSVC exploitation value is none.

Which QuNetSwitch version fixes the issue?

According to the vendor description, the issue is fixed in QuNetSwitch 2.0.5.0906 and later. Users on earlier builds should update.

Why is there a difference between the NVD score and the QNAP score?

NVD assigns a base score of 9.8, while the QNAP CNA assigns 6.8. The record does not explain the difference, so the scoring basis should be checked in the sources.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.