EUVD-2025-32467Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain QNAP admin credentials
-
ExploitAuthenticate to management interface
-
ExecutionSend crafted request triggering NULL deref
-
ImpactService/device crash (DoS)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to first possess a valid QNAP administrator account on the device, as explicitly stated in the description and reflected by PR:H in the CVSS vector - this is the primary limiting factor and means the flaw is not reachable by unauthenticated or low-privileged users. No user interaction is required (UI:N) and the vector is network-reachable (AV:N) once admin access is held. Affected deployments are QTS 5.2.x and QuTS hero h5.2.x below build 20250715; devices updated to QTS 5.2.6.3195 / QuTS hero h5.2.6.3195 (build 20250715) or later are not vulnerable. Impact is limited to a denial of service with no data exposure or modification. |
| Impact | This is a genuinely low-priority vulnerability despite its MEDIUM CVSS rating. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L) scores only 5.1 and already reflects the core limiter: PR:H means the attacker must already hold an administrator account before the flaw is reachable. An attacker with administrator rights on a QNAP NAS can typically disrupt service through legitimate means anyway, so the marginal risk added by this NULL pointer dereference is modest. The supporting signals reinforce low urgency: EPSS is 0.14% (34th percentile), there is no CISA KEV listing, and no public exploit code is referenced. Impact is confined to availability (VA:L, a transient DoS) with no confidentiality or integrity effect. The signals are consistent with one another - low EPSS, no KEV, no POC, and a high-privilege precondition all point the same direction. The only cross-source note worth flagging: the description says a remote attacker must 'gain an administrator account,' which aligns with PR:H in the vector, so there is no network-vs-privilege contradiction to resolve. Treat this as routine patch-cycle hygiene, not an emergency. |
| Exploit ScenarioDerived | An attacker who has already obtained QNAP administrator credentials (via phishing, credential reuse, or a separate auth flaw) sends a crafted request over the network to the management interface that triggers the NULL pointer dereference, crashing the affected service or the device and causing a denial of service. No public exploit code has been identified, and exploitation is gated entirely behind prior administrative access. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 18, 2026
QNAP QTS and QuTS hero contain a NULL pointer dereference that can be triggered by a remote attacker with an administrator account, resulting in a low-impact denial-of-service condition. Affected devices are QTS 5.2.x and QuTS hero h5.2.x before build 20250715, and the vendor has released QTS 5.2.6.3195 and QuTS hero h5.2.6.3195 (build 20250715). No public exploit code or confirmed active exploitation was identified in the provided intelligence, and EPSS is low at 0.14%.
Earlier versions of this analysis (1)
RemediationAI
Upgrade to QTS 5.2.6.3195 build 20250715 or later, or QuTS hero h5.2.6.3195 build 20250715 or later, as documented in QNAP advisory QSA-25-36 (https://www.qnap.com/en/security-advisory/qsa-25-36). Because exploitation requires an administrator account, interim risk reduction should focus on restricting and monitoring administrative access: remove unnecessary admin accounts, enforce strong authentication, limit the management interface to trusted networks or VPN, and disable remote administration where feasible, accepting that these controls reduce exposure but do not fix the underlying NULL pointer dereference. Patch availability is vendor-confirmed; no public exploit was identified at time of analysis.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-476, a NULL pointer dereference in QNAP operating system code. The CVSS vector’s PR:H and the vendor description both establish that a valid QNAP administrator account is required; AV:N means the flaw is network-reachable after that prerequisite, not that it is exposed to unauthenticated users. Triggering the dereference can terminate or destabilize an affected service, yielding only low availability impact (VA:L) with no confidentiality or integrity effect (VC:N/VI:N). Affected branches are QTS 5.2.x and QuTS hero h5.2.x below the vendor-fixed build.
Know when Qts gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Requires a pre-existing administrator account so PR:H; network-reachable with no user interaction; only a transient DoS, hence C:N/I:N and A:L.
Primary rating from Vendor (qnapsecurity).
CVSS VectorVendor: qnapsecurity
Lifecycle Timeline
3DescriptionCVE.org
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.
We have already fixed the vulnerability in the following versions: QTS 5.2.6.3195 build 20250715 and later QuTS hero h5.2.6.3195 build 20250715 and later
Executive ViewAI
Organizations using A NULL pointer dereference vulnerability should be aware of moderate risk from CVE-2025-52427, a null pointer dereference vulnerability rated CVSS 4.9. Exploitation could compromise the security of affected deployments. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: enable ASLR/DEP, apply network segmentation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
QNAP QTS before 4.2.4 Build 20170313 allows attackers to execute arbitrary commands via unspecified vectors. Rated criti
QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and obtain sensitive information
QNAP has patched a remote code execution vulnerability affecting the QTS Media Library in all versions prior to QTS 4.2.
QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and execute arbitrary commands vi
QNAP QTS before 4.2.4 Build 20170313 allows local users to obtain sensitive Domain Administrator password information by
This command injection vulnerability in QTS allows attackers to run arbitrary commands in the compromised application. R
This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. Rated criti
A prototype pollution vulnerability has been reported to affect several QNAP operating system versions. Rated high sever
A buffer overflow vulnerability in external device function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 2
A buffer overflow vulnerability in password function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117
GitHub PoC
Exploit-DB