HybridDesk Station 4.2.22+ Auth Bypass in Critical Function
CVE-2026-39997 Published on October 15, 2026
Unauthenticated Remote Input Injection in QNAP HD Station's remotepad
A missing authentication for critical function vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to gain access to the system.
We have already fixed the vulnerability in the following version:
HybridDesk Station 4.2.22 and later
Vulnerability Analysis
Attack Vector:
ADJACENT
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
PASSIVE
Weakness Type
Missing Authentication for Critical Function
The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Affected Versions
QNAP Systems Inc. HybridDesk Station:- Version 4.2.x and below 4.2.22 is affected.