Missing Auth in sMedio DTCP MOVE 1.4.5+ Remote Access
CVE-2026-34006 Published on October 15, 2026

Pre-Authentication Multiple Critical Vulnerabilities in QNAP sMedioDTCPServer
A missing authentication for critical function vulnerability has been reported to affect sMedio DTCP MOVE. If exploited, the vulnerability could allow remote attackers to gain access to the system. We have already fixed the vulnerability in the following version: sMedio DTCP MOVE 1.4.5 and later

NVD

Vulnerability Analysis

CVE-2026-34006 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE

Weakness Type

Missing Authentication for Critical Function

The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.


Affected Versions

QNAP Systems Inc. sMedio DTCP MOVE: