QNAP QTS CVE-2025-52855

Exploitation requires the attacker to already possess a valid QNAP administrator account on the target device (PR:H) - this is the explicit prerequisite stated in the vendor description ('if a remote attacker gains an administrator account'). Affected products are QTS 5.2.x and QuTS hero h5.2.x builds prior to the 20250715 (build 3195) fix; devices already updated to QTS 5.2.6.3195/QuTS hero h5.2.6.3195 or later are not vulnerable. No user interaction is required (UI:N) and attack complexity is low (AC:L), but the mandatory administrator authentication is the dominant limiting factor, confining realistic exploitation to insiders or attackers who have already compromised admin credentials; impact is limited to a denial of service with no data disclosure or modification.

This is a genuinely low-priority issue despite a CVSS 4.0 base score of 5.1 (Medium). The signals are consistent and point to low real-world risk: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N) requires high privileges - PR:H, corroborated by the description stating 'if a remote attacker gains an administrator account' - and the only impact is low availability (VA:L), i.e. a denial of service against the device's own OS with no confidentiality or integrity loss (VC:N/VI:N). EPSS is 0.14% (34th percentile), indicating very low predicted exploitation likelihood, and there is no CISA KEV listing and no public exploit code identified, so the signals do not conflict. The critical limiting factor is that an attacker must already hold a QNAP administrator account, which largely neutralizes the 'network' attack vector: an actor with admin on a NAS already has far more impactful options than crashing it, so this is best viewed as a robustness/defense-in-depth fix rather than an urgent threat. No key data is conflicting; the main caveat is that affected-version detail comes from NVD/EUVD and the vendor advisory rather than independent testing.

An attacker who has already obtained QNAP administrator credentials (via phishing, credential reuse, or a prior compromise) sends a crafted request over the network to a vulnerable QTS or QuTS hero management interface, triggering a NULL pointer dereference that crashes the affected service or OS and denies storage access to legitimate users. No public proof-of-concept exploit has been identified. Because exploitation demands an existing admin account (PR:H) with low attack complexity, the barrier is credential access rather than technical difficulty.