Security Advisory for Command Injection in Video Station

Summary

A command injection vulnerability was recently found in Video Station. If exploited, this vulnerability may allow a remote attacker to run arbitrary commands on the NAS. We have already patched this vulnerability in Video Station versions 5.1.4 and 5.2.1.

Recommendations

To resolve the issue, you must update your Video Station to the latest version:

• For QTS 4.3.3: Video Station 5.1.4
• For QTS 4.3.4: Video Station 5.2.1

Upgrading to Video Station 5.1.4 or 5.2.1

1. Log on to QTS as administrator.
2. Open the App Center, and then click the Search icon.
   A search box appears.
3. Type “Video Station”, and then press ENTER.
   The Video Station application appears in the search results list.
4. Click Update.
   A confirmation message appears.
5. Click OK.
   The application is updated.