EUVD-2025-32458Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with administrator account
-
ExploitSend crafted request triggering NULL dereference
-
ImpactCrash service causing denial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already hold a valid QNAP administrator account on the target device (CVSS PR:H) - this is the primary limiting factor and excludes unauthenticated or low-privileged attackers entirely. The flaw affects QTS 5.2.x and QuTS hero h5.2.x operating-system builds prior to build 20250715 (fixed in 5.2.6.3195 / h5.2.6.3195 build 20250715). No special non-default feature or configuration toggle is cited by the vendor; the request is network-deliverable (AV:N) without user interaction (UI:N), but the admin-credential precondition, combined with the availability-only (DoS) impact, substantially narrows realistic exploitation to already-compromised or insider scenarios. |
| Impact | This is a genuinely low-priority issue despite being network-reachable. The CVSS 4.0 vector (AV:N/AC:L/PR:H/UI:N, VA:L, all other impacts N) scores only 5.1 (Medium) and is driven almost entirely by network reach; the PR:H requirement is the dominant limiting factor - the attacker must already possess a valid administrator account on the QNAP device before the NULL pointer dereference (CWE-476) can be triggered. The only consequence is a low-impact denial of service (VA:L); there is no confidentiality or integrity impact. Corroborating signals align rather than conflict: EPSS is very low at 0.14% (34th percentile), there is no CISA KEV listing, and no public exploit code was provided in the input. All signals point the same direction - a real, vendor-confirmed bug, but one whose exploitation prerequisite (pre-existing admin access) means an attacker who could exploit it can already reconfigure or reboot the device anyway, sharply reducing its practical value as an attack primitive. |
| Exploit ScenarioDerived | An attacker who has already obtained QNAP administrator credentials (e.g., via prior compromise, phishing, or reused credentials) sends a crafted request over the network that triggers a NULL pointer dereference in a QTS/QuTS hero component, crashing the affected service or device and causing a denial of service. No public exploit code was identified in the provided data, and the low availability-only impact plus mandatory admin privilege make this a low-value post-compromise nuisance rather than an initial-access vector. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 18, 2026
Denial-of-service conditions can be triggered in QNAP QTS and QuTS hero 5.2.x through a NULL pointer dereference that requires the attacker to already hold a valid administrator account on the target NAS. The flaw is network-reachable and needs no user interaction, but the administrator-credential precondition and availability-only impact keep practical risk low; EPSS is 0.14% and no public exploit identified at time of analysis. Vendor-released fixed builds are QTS 5.2.6.3195 build 20250715 and QuTS hero h5.2.6.3195 build 20250715 and later.
Earlier versions of this analysis (1)
RemediationAI
Upgrade to QTS 5.2.6.3195 build 20250715 or later, or QuTS hero h5.2.6.3195 build 20250715 or later, as documented in QNAP QSA-25-36 (https://www.qnap.com/en/security-advisory/qsa-25-36). Because exploitation requires an existing administrator account, compensating controls before upgrade should focus on reducing admin-credential exposure: restrict NAS management interfaces to trusted networks or VPN, remove unused administrator accounts, enforce strong authentication or MFA where supported, and monitor for unexpected service crashes or restarts. These measures lower the chance that a compromised admin account can be used to trigger the NULL dereference, but they do not remediate the flaw, and restricting management access can impede legitimate remote administration.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-476 NULL pointer dereference occurs when software follows a pointer that is NULL, typically because an object lookup, allocation, or return value was not validated before use. In QNAP QTS and QuTS hero, the consequence described is a crash of the affected service or process, producing availability impact rather than code execution, data disclosure, or integrity loss. The vendor-supplied CVSS 4.0 vector scores 5.1 and uses AV:N/AC:L/AT:N/PR:H/UI:N/VA:L, while the independent assessment expresses the same prerequisites in CVSS 3.1 as AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L. NVD CPE entries enumerate affected QTS 5.2.x builds including cpe:2.3:o:qnap:qts:5.2.0.2737:build_20240417:*:*:*:*:*:* through cpe:2.3:o:qnap:qts:5.2.3.3006:build_20250108:*:*:*:*:*:*; EUVD also lists QuTS hero h5.2.x before h5.2.6.3195 build 20250715.
Know when Qts gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Network-reachable (AV:N) and low complexity (AC:L), but requires a pre-existing administrator account (PR:H); impact is availability-only DoS (A:L), with no confidentiality or integrity effect.
Primary rating from Vendor (qnapsecurity).
CVSS VectorVendor: qnapsecurity
Lifecycle Timeline
3DescriptionCVE.org
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.
We have already fixed the vulnerability in the following versions: QTS 5.2.6.3195 build 20250715 and later QuTS hero h5.2.6.3195 build 20250715 and later
Executive ViewAI
Organizations using A NULL pointer dereference vulnerability should be aware of moderate risk from CVE-2025-48728, a null pointer dereference vulnerability rated CVSS 4.9. Exploitation could compromise the security of affected deployments. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: enable ASLR/DEP, apply network segmentation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
QNAP QTS before 4.2.4 Build 20170313 allows attackers to execute arbitrary commands via unspecified vectors. Rated criti
QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and obtain sensitive information
QNAP has patched a remote code execution vulnerability affecting the QTS Media Library in all versions prior to QTS 4.2.
QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and execute arbitrary commands vi
QNAP QTS before 4.2.4 Build 20170313 allows local users to obtain sensitive Domain Administrator password information by
This command injection vulnerability in QTS allows attackers to run arbitrary commands in the compromised application. R
This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. Rated criti
A prototype pollution vulnerability has been reported to affect several QNAP operating system versions. Rated high sever
A buffer overflow vulnerability in external device function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 2
A buffer overflow vulnerability in password function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117
GitHub PoC
Exploit-DB