QNAP QTS CVE-2025-52429

Requires a valid administrator account on the affected QNAP NAS (CVSS PR:H) - this is the primary limiting factor and excludes unauthenticated or low-privilege remote attackers. The flaw is an externally-controlled format string (CWE-134) reachable over the network (AV:N) with low complexity and no user interaction, meaning once admin access is held, exploitation is straightforward. Affected deployments are QTS 5.2.x prior to 5.2.6.3195 build 20250715 and QuTS hero h5.2.x prior to h5.2.6.3195 build 20250715; patched builds are not exploitable. No non-default feature toggle is named in the advisory, so the condition is effectively the administrator privilege level plus a vulnerable firmware build.

This is a genuinely low-to-moderate priority issue despite the CWE-134 format string class. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/PR:H/UI:N, VC:N/VI:N/VA:L) yields only 5.1 and is dominated by the PR:H requirement - the attacker must already possess an administrator account, which drastically narrows the realistic threat population to post-authentication/insider or credential-compromise scenarios. EPSS is 0.05% (16th percentile), consistent with no public exploitation interest, and the CVE is NOT in CISA KEV and has no known POC, so exploitation status is 'no public exploit identified at time of analysis.' A notable internal conflict exists: the description states an attacker can 'obtain secret data or modify memory' (implying confidentiality and integrity impact), yet the vendor's CVSS 4.0 vector marks VC:N and VI:N and only VA:L (availability low) - the vendor's scored impact contradicts its own prose. This discrepancy should be verified with QNAP, as a format-string info-leak would normally carry at least low confidentiality impact. No SSVC decision data was provided. Overall: real but low-urgency, gated behind administrator access, with no evidence of active or opportunistic exploitation.

An attacker who has already obtained QNAP NAS administrator credentials (via phishing, credential reuse, or prior compromise) sends crafted input containing format-string specifiers to an affected QTS/QuTS hero management function. The malformed format string is processed, allowing the attacker to read adjacent memory (leaking secret data) or write to memory. No public exploit code is known, and exploitation requires pre-existing administrative access.