Music Station - Authentication Bypass (CVE-2023-45038)

CVE-2023-45038 is an improper authentication vulnerability in QNAP Music Station that could allow remote attackers to compromise system security over the network. Exploiting this flaw may enable unauthorized users to gain limited access to sensitive information or system resources.

CrowdSec has been tracking this vulnerability and its exploits since 7th of January 2026.

Data from the CrowdSec community indicates that exploitation of CVE-2023-45038 is highly selective and intelligence-driven. Threat actors use advanced reconnaissance and carefully choose their targets, often as part of sophisticated campaigns or advanced persistent threat operations. Data from the CrowdSec community also indicates a gradual decrease in attacks targeting CVE-2023-45038. While still present in the wild, exploitation levels have dropped noticeably week-over-week. This may signal that the vulnerability is becoming less relevant or that defenses are improving fast enough for attackers to lose interest.

Attackers exploit the /musicstation/api/as_get_file_api.php endpoint by sending unauthenticated POST requests with crafted parameters to bypass authentication and access sensitive files such as /etc/passwd.