Music Station - Authentication Bypass (CVE-2023-45038)

CVE-2023-45038 is an improper authentication vulnerability in QNAP Music Station that could allow remote attackers to compromise system security over the network. Exploiting this flaw may enable unauthorized users to gain limited access to sensitive information or system resources.

CrowdSec has been tracking this vulnerability and its exploits since 7th of January 2026.

CrowdSec network observations suggest that most exploitation of CVE-2023-45038 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental. Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2023-45038 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2023-45038 is currently experiencing high visibility and active exploitation across the internet.

Attackers exploit the /musicstation/api/as_get_file_api.php endpoint by sending unauthenticated POST requests with crafted parameters to bypass authentication and access sensitive files such as /etc/passwd.