CVE-2025-44015
Published: 29 August 2025
Summary
CVE-2025-44015 is a low-severity Command Injection (CWE-77) vulnerability in Qnap Hybriddesk Station. Its CVSS base score is 2.3 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 42.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-44015 is a command injection vulnerability (CWE-77, CWE-78) affecting HybridDesk Station, a component from QNAP. The issue allows attackers to execute arbitrary commands on the affected system. It has a CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for complete compromise of confidentiality, integrity, and availability.
An attacker with local network access can exploit this vulnerability without authentication or user interaction. Successful exploitation enables arbitrary command execution on the target system, potentially leading to full system takeover, data theft, or further lateral movement within the network.
QNAP has addressed the vulnerability in HybridDesk Station version 4.2.18 and later. Security practitioners should update to a patched version immediately. Additional details are available in QNAP's security advisory at https://www.qnap.com/en/security-advisory/qsa-25-20.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-28019
Vulnerability details
A command injection vulnerability has been reported to affect HybridDesk Station. If an attacker gains local network access, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following version: HybridDesk Station…
more
4.2.18 and later
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection vulnerability directly enables remote arbitrary command execution on a network-accessible component (T1190) and facilitates use of command interpreters for follow-on actions (T1059).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the command injection vulnerability by requiring timely identification, reporting, and correction through patching to HybridDesk Station 4.2.18 or later.
Prevents exploitation of the command injection vulnerability by implementing input validation to mitigate information injection attacks like CWE-77 and CWE-78.
Enforces input restrictions to limit types and quantities of data that could be used to exploit the command injection vulnerability and enable arbitrary command execution.