CVE-2023-39299

Music Station

HIGH

7.5

CVSS Score

Published: November 3, 2023 at 04:34 PM UTC

Updated: June 17, 2026 at 06:11 AM UTC

1 product affected across 1 vendorMusic Station

Using Music Station by QNAP Systems Inc.?

Get instant alerts when new vulnerabilities affect Music Station - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.5

Exploit prediction

EPSS 0.6%

SSVC

No known exploit

Description

A path traversal vulnerability has been reported to affect Music Station. If exploited, the vulnerability could allow users to read the contents of unexpected files and expose sensitive data via a network. We have already fixed the vulnerability in the following versions: Music Station 4.8.11 and later Music Station 5.1.16 and later Music Station 5.3.23 and later

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Music Station · Qnap

95%

4.8.0 ≤ v < 4.8.114.8.x ≤ v < 4.8.115.1.0 ≤ v < 5.1.165.1.x ≤ v < 5.1.165.3.0 ≤ v < 5.3.235.3.x ≤ v < 5.3.234.8.x 5.1.x 5.3.x

Affected range stops below 4.8.11, so it looks safe — our inference, not a vendor statement

Affected range stops below 5.1.16, so it looks safe — our inference, not a vendor statement

Affected range stops below 5.3.23, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

https://www.qnap.com/en/security-advisory/qsa-23-61

References (1)

Vendor Advisory

Source: [email protected]

https://www.qnap.com/en/security-advisory/qsa-23-61

SSVC — Action Prioritization

SSVCNo known exploitAutomatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

7.5HIGHqnap

Attack Vector: NETWORK
Complexity: LOW
Privileges: NONE
User Interaction: NONE
Scope: UNCHANGED
Confidentiality: HIGH
Integrity: NONE
Availability: NONE

Vector?

Quick Info

StatusMODIFIED

CWE

CWE-22

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card