CVE-2025-44015CWE-77CWE-78command-injection

CVE-2025-44015

High · published August 29, 2025

CVSS v3.1
8.4
EPSS
1%
Percentile
59.1
In the wild
Unconfirmed
What it is

A command injection vulnerability has been reported to affect HybridDesk Station. If an attacker gains local network access, they can then exploit the vulnerability to execute arbitrary commands.

We have already fixed the vulnerability in the following version:

HybridDesk Station 4.2.18 and later

The record
Technical detail
CVSS v3.1
8.4 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00895 · 59.1th percentile
Weaknesses
CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection'); CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2025-08-29T22:15Z
Affected products (1)
ProductVersionsFixed in
qnap/hybriddesk_station≥ 4.2.0, < 4.2.184.2.18
References (1)
https://www.qnap.com/en/security-advisory/qsa-25-20 · [email protected]
EPSS history
Timeline
  • 29 AUG 17:17Z
    HybridDesk Station
    cvelistv5