CVE-2023-45038 is a medium severity improper authentication flaw in QNAP Music Station, scored 4.3 by NVD. QNAP fixed it in Music Station 5.4.0 and later. Update the app from the App Center, remove it if you do not use it, and review which QNAP services face the internet.
What's affected
The record says an improper authentication vulnerability affects Music Station, and that QNAP fixed it in Music Station 5.4.0 and later. It does not give a lower bound for affected versions, so any release before 5.4.0 should be treated as affected. The record was published on 2024-09-06 and cites QNAP advisory QSA-24-25.
NVD scores it 4.3, Medium, with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N. The attack is over the network, needs no privileges and needs a user to act, with a low confidentiality impact.
The advisory page did not render when I fetched it. The fixed version is taken from the NVD record text, which quotes the advisory.
The record says the flaw could let users compromise the security of the system via a network. That wording is broader than the score suggests, so read the advisory for specifics.
Weakness class: CWE-287 (improper authentication).
How to check if you're exposed
Open the QNAP App Center, find Music Station among the installed apps, and read its version. Anything below 5.4.0 should be updated. On the command line of the device you can also list installed packages, but the App Center is the simpler route.
If you do not use Music Station, check whether it is installed at all. Unused apps still count as attack surface.
What to do now
- Check every QNAP device for Music Station and note the version.
- Update Music Station to 5.4.0 or later from the App Center.
- Uninstall or disable Music Station on devices that do not need it.
- Make sure the NAS operating system is current too, since apps depend on it.
- Keep media services off the public internet where you can, and use a VPN for remote listening.
Why it matters
Improper authentication, tracked as CWE-287, means the application does not properly confirm who is making a request. Fixing it usually means tightening the check so that an action needs proof of identity.
The score is Medium because the stated impact is limited to a small loss of confidentiality and because a user has to take part. Media apps on a NAS often share the device with backups and documents, so a hole in a minor app matters more than its score says. CVE-2023-45038 is not on the CISA Known Exploited Vulnerabilities list, and none of the pages I read says it has been exploited in the wild. That is a statement about what is recorded, not a reason to delay.
Quick check
Which version fixes CVE-2023-45038?
Music Station 5.4.0 and later, per the record text quoting QNAP.
Do I need to patch if I do not use Music Station?
If it is installed, update or remove it. An unused app can still be reached.
Sources
- Gold entry for CVE-2023-45038
- QNAP advisory QSA-24-25 (page did not render when fetched; text taken from the NVD record)
Last reviewed: 19 October 2026.
