A cross-site scripting

CVE-2026-41539 is a cross-site scripting flaw (CWE-79) in the web administration interface of QNAP's QTS and QuTS hero NAS firmware. Insufficient input validation and output encoding on one or more admin pages let an unauthenticated attacker craft a URL that, when opened by a logged-in QNAP user, executes attacker-controlled JavaScript inside the admin session. Affected builds are fixed in QTS 5.2.9.3492 build 20260507, QuTS hero h5.2.9.3499 build 20260514, h5.3.4.3500 build 20260520, and h6.0.0.3500 build 20260520.

QNAP scores this 6.1 MEDIUM (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) and that is roughly right. VulDB's 8.7 is inflated for a reflected XSS with mandatory user interaction and no direct integrity/availability impact. The realistic worst case is session hijack of the admin who clicks the link — which on a NAS *is* meaningful (data at rest), but it does not chain to unauth RCE and it does not touch users who never open the crafted URL.

Why this verdict

• User interaction required (UI:R): the payload only fires when a logged-in admin opens the crafted URL — no server-side worm potential.
• No integrity or availability impact in the base vector: C:L/I:L/A:N caps the direct damage at session-scoped confidentiality and low-integrity DOM tampering.
• Role multiplier: a QNAP NAS is a data-tier appliance — a hijacked admin session can enumerate shares and potentially create backdoor accounts, which is why we do not downgrade to LOW. Blast radius is one appliance and its data, not the fleet.
• No public PoC, no KEV, EPSS 0.2%: external exploitation pressure is near zero as of 2026-07-01.
• Exposure friction: most enterprise QNAP admin UIs are internal-only or behind myQNAPcloud relay — external attackers rarely have a direct path to phish a session that is live against the NAS.

Why not higher?

Elevating to HIGH would require either unauthenticated RCE, a stored XSS that hits users passively, or evidence of active exploitation. None apply here — the chain has a mandatory human-click gate and no privilege escalation primitive documented.

Why not lower?

LOW would ignore the fact that a NAS admin session grants access to bulk data at rest and to service-enable primitives (SSH, WebDAV, snapshots). On a data-tier device that is not a hygiene bug; it deserves the 365-day remediation clock, not the ignore pile.

1. Remove QNAP admin UIs from the public internet — Put the web UI behind VPN or a reverse proxy with SSO. No mitigation SLA at MEDIUM, but this is the single most valuable durable control against every QNAP web-tier CVE — do it as part of the 365-day remediation window.
2. Enforce QNAP 2-Step Verification for all administrator accounts — Even if a session cookie is stolen, sensitive admin actions require the second factor. Enable via Control Panel → Users → 2-step Verification.
3. Segment NAS admin browsing to a jump host — Admins should not open random links in the same browser profile that holds a live QTS session. A dedicated admin workstation or Privileged Access Workstation (PAW) breaks step 2 of the chain.
4. Forward QNAP System Logs to SIEM — Watch for administrator account creation, SSH/WebDAV enablement, and unusual outbound POSTs. Detect the post-exploitation phase even if the XSS itself flies under the radar.
5. Patch to fixed builds during the normal 365-day window — Apply QTS 5.2.9.3492 / QuTS hero h5.2.9.3499 / h5.3.4.3500 / h6.0.0.3500 as part of the noisgate remediation SLA; no need for an emergency change window.

Run on an auditor workstation with network reach to the QNAP appliance. Invoke as .\Check-QNAP-CVE-2026-41539.ps1 -NasHost nas01.corp.local. No admin creds required — reads the unauthenticated firmware banner exposed on /cgi-bin/authLogin.cgi.

#!/usr/bin/env pwsh
# noisgate verification for CVE-2026-41539 (QNAP QTS / QuTS hero XSS)
# Exit 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN
param(
    [Parameter(Mandatory=$true)][string]$NasHost,
    [int]$Port = 443,
    [switch]$Insecure
)

$ErrorActionPreference = 'Stop'
if ($Insecure) {
    [System.Net.ServicePointManager]::ServerCertificateValidationCallback = { $true }
}

$uri = "https://${NasHost}:${Port}/cgi-bin/authLogin.cgi"
try {
    $resp = Invoke-WebRequest -Uri $uri -Method GET -TimeoutSec 10 -UseBasicParsing
} catch {
    Write-Output "UNKNOWN: could not reach $uri ($_)"
    exit 2
}

$body = $resp.Content
$fwMatch  = [regex]::Match($body, '<version><!\[CDATA\[([^\]]+)\]\]></version>')
$blMatch  = [regex]::Match($body, '<build><!\[CDATA\[([^\]]+)\]\]></build>')
$modelM   = [regex]::Match($body, '<modelName><!\[CDATA\[([^\]]+)\]\]></modelName>')

if (-not $fwMatch.Success -or -not $blMatch.Success) {
    Write-Output "UNKNOWN: could not parse firmware banner"
    exit 2
}

$fw    = $fwMatch.Groups[1].Value.Trim()          # e.g. 5.2.9.3492
$build = $blMatch.Groups[1].Value.Trim()          # e.g. 20260507
$model = if ($modelM.Success) { $modelM.Groups[1].Value } else { 'unknown' }

# Fixed matrix (major.minor -> minimum full version, minimum build date)
$fixed = @{
    'QTS-5.2'      = @{ Ver = '5.2.9.3492'; Build = 20260507 }
    'QuTS-h5.2'    = @{ Ver = '5.2.9.3499'; Build = 20260514 }
    'QuTS-h5.3'    = @{ Ver = '5.3.4.3500'; Build = 20260520 }
    'QuTS-h6.0'    = @{ Ver = '6.0.0.3500'; Build = 20260520 }
}

# Heuristic: banner uses leading 'h' for QuTS hero builds
$isHero = $fw.StartsWith('h') -or $model -match 'h[0-9]'
$fwClean = $fw.TrimStart('h')
$majMin = ($fwClean.Split('.')[0..1] -join '.')
$key = if ($isHero) { "QuTS-h$majMin" } else { "QTS-$majMin" }

if (-not $fixed.ContainsKey($key)) {
    Write-Output "UNKNOWN: unrecognized branch $key (fw=$fw build=$build model=$model)"
    exit 2
}

$target = $fixed[$key]
$verOK   = [version]$fwClean -ge [version]$target.Ver
$buildOK = [int]$build -ge $target.Build

if ($verOK -and $buildOK) {
    Write-Output "PATCHED: $model fw=$fw build=$build (>= $($target.Ver) build $($target.Build))"
    exit 0
} else {
    Write-Output "VULNERABLE: $model fw=$fw build=$build (needs $($target.Ver) build $($target.Build) or newer)"
    exit 1
}

Sources

1. QNAP Security Advisory QSA-26-31
2. GitHub Security Advisory GHSA-hc5c-8r54-29r3
3. VulDB 369456
4. VulDB CVE-2026-41539
5. INCIBE-CERT CVE-2026-41539
6. OpenCVE CVE-2026-41539
7. Vulnerability-Lookup (CIRCL) CVE-2026-41539
8. THREATINT CVE-2026-41539