CVE-2024-56804: QNAP Video Station SQLi Vulnerability

CVE-2024-56804 Overview

CVE-2024-56804 is a SQL injection vulnerability [CWE-89] affecting QNAP Video Station. A remote attacker who has obtained a valid user account can exploit the flaw to execute unauthorized code or commands against the underlying database and application. QNAP addressed the issue in Video Station 5.8.4 and later. The vulnerability requires low privileges and no user interaction, and it is exploitable over the network.

Critical Impact
Authenticated remote attackers can inject SQL statements into Video Station to run unauthorized code or commands on affected QNAP NAS deployments.

Affected Products

QNAP Video Station versions prior to 5.8.4
QNAP NAS devices with Video Station installed
Deployments exposing Video Station to remote authenticated users

Discovery Timeline

2025-10-03 - CVE-2024-56804 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-56804

Vulnerability Analysis

CVE-2024-56804 is classified as Improper Neutralization of Special Elements used in an SQL Command [CWE-89]. Video Station accepts user-supplied input and incorporates it into SQL queries without adequate sanitization or parameterization. An authenticated attacker can craft input that breaks out of the intended query context and appends attacker-controlled SQL. QNAP's advisory states that successful exploitation allows execution of unauthorized code or commands, indicating the injection can reach beyond data disclosure into command execution paths within the application. The attack is network-reachable and does not require user interaction, but it does require a valid Video Station user account.

Root Cause

The root cause is unsafe construction of SQL statements from user-controlled parameters inside Video Station request handlers. Input reaches the database layer without prepared statements or strict input validation. This allows syntactic manipulation of the query and downstream logic that Video Station uses to execute code or commands.

Attack Vector

Exploitation requires network access to Video Station and any authenticated account, including low-privileged users. The attacker submits crafted HTTP requests containing SQL metacharacters through vulnerable Video Station endpoints. Because the application executes unauthorized code or commands based on injected SQL, an attacker can pivot from database manipulation to broader compromise of the media service on the NAS. The QNAP advisory QSA-25-32 confirms the scope of impact and the fixed version.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the QNAP Security Advisory QSA-25-32 for vendor details.

Detection Methods for CVE-2024-56804

Indicators of Compromise

HTTP requests to Video Station endpoints containing SQL metacharacters such as ', --, UNION SELECT, or ; in parameter values
Video Station or database logs showing malformed queries, syntax errors, or unusually long parameter values from authenticated sessions
Unexpected child processes spawned by Video Station service accounts on the NAS
Authentication events for low-privileged Video Station accounts followed by anomalous query patterns

Detection Strategies

Enable verbose logging on Video Station and forward web-access logs to a centralized analytics platform for SQL injection pattern matching
Deploy signatures for common SQLi payloads against QNAP web management traffic at the network layer
Correlate authenticated Video Station sessions with process execution telemetry on the NAS to identify command execution paths

Monitoring Recommendations

Monitor QNAP NAS devices for outbound connections initiated by Video Station processes after authenticated requests
Alert on repeated 4xx/5xx responses from Video Station endpoints that suggest injection probing
Track creation of new Video Station accounts and unusual privilege changes that could precede exploitation

How to Mitigate CVE-2024-56804

Immediate Actions Required

Upgrade Video Station to version 5.8.4 or later on all QNAP NAS devices
Remove Video Station from devices where it is not required
Restrict Video Station access to trusted networks and disable direct internet exposure
Audit existing Video Station user accounts and remove unused or shared credentials

Patch Information

QNAP fixed CVE-2024-56804 in Video Station 5.8.4 and later. Administrators should install the update through the QNAP App Center or download it from the vendor site. Refer to the QNAP Security Advisory QSA-25-32 for official remediation guidance.

Workarounds

Uninstall Video Station until the patched version can be deployed
Place the NAS behind a VPN and block external access to the Video Station web interface
Enforce strong, unique passwords and multi-factor authentication on all NAS accounts to reduce the risk of credential-based access

bash

# Verify installed Video Station version on a QNAP NAS via SSH
qpkg_cli --list | grep -i "Video Station"

# Disable Video Station until patched
qpkg_cli --disable VideoStation