EUVD-2025-32436Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain QNAP admin credentials
-
ExploitAuthenticate to device over network
-
ExecutionSend crafted request triggering NULL deref
-
ImpactCrash service causing denial-of-service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already possess a QNAP administrator account on the target device (PR:H), so this is strictly a post-authentication, privileged-abuse condition rather than a remote unauthenticated flaw. Affected products are QTS 5.2.x and QuTS hero h5.2.x prior to the 5.2.6.3195 / h5.2.6.3195 build 20250715 fixes; no special non-default feature or configuration is named in the advisory. The dominant limiting factor is the administrator-account prerequisite, which confines realistic risk to insider misuse or scenarios where admin credentials are already compromised; impact is limited to availability (device/service crash) with no confidentiality or integrity effect. |
| Impact | This is a genuinely low-priority issue despite a MEDIUM CVSS 4.0 score of 5.1. The signals are mutually consistent rather than conflicting: the CVSS vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L) shows network reach and low complexity, but gating on PR:H (high privileges) means the attacker must already hold a QNAP administrator account - a precondition that drastically narrows the realistic threat. Impact is limited to availability only (VA:L, with VC:N/VI:N), reflecting a CWE-476 NULL pointer dereference that causes a denial-of-service crash, not code execution or data compromise. EPSS corroborates the low urgency at 0.14% (34th percentile), and there is no CISA KEV listing and no public exploit, so there is no evidence of exploitation. The practical risk is bounded: an admin-authenticated DoS is largely an abuse-of-trust/post-compromise concern rather than an externally weaponizable flaw. No key data is conflicting; the main caveat is that the only impact worth patching for is service disruption by an already-privileged actor. |
| Exploit ScenarioDerived | An attacker who has already obtained QNAP administrator credentials (e.g., via phishing, credential reuse, or an earlier compromise) sends a crafted request over the network that triggers a NULL pointer dereference, crashing the affected service or device and denying availability to legitimate users. No public exploit code has been identified, and the requirement for an administrator account makes this a post-authentication abuse scenario rather than opportunistic mass exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 18, 2026
Privileged denial-of-service in QNAP QTS and QuTS hero lets an attacker who already holds an administrator account crash affected NAS services by triggering a NULL pointer dereference. QTS 5.2.x and QuTS hero h5.2.x before 5.2.6.3195 build 20250715 are affected; impact is availability-only and requires high privileges, and no public exploit has been identified at time of analysis (EPSS 0.14%).
Earlier versions of this analysis (1)
RemediationAI
Upgrade to QTS 5.2.6.3195 build 20250715 or later, or QuTS hero h5.2.6.3195 build 20250715 or later, as documented in QNAP advisory QSA-25-36 (https://www.qnap.com/en/security-advisory/qsa-25-36). Because exploitation requires an existing administrator account, reduce exposure by enforcing strong unique admin credentials, disabling default or unused administrator accounts where possible, restricting management-interface access to trusted networks or VPN, and auditing for compromised admin sessions. If immediate upgrade is not possible, these access-control and credential-hardening measures lower the likelihood of privileged misuse but do not remove the underlying NULL pointer dereference, and no other vendor workaround is identified in the provided data.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-476 NULL pointer dereference in QNAP's NAS operating system. When a user with administrator privileges reaches the vulnerable code path, the process dereferences a null pointer and terminates, producing a denial-of-service condition. The supplied CPE data enumerates QuTS hero builds h5.2.0.2737 through h5.2.2.2952, and EUVD extends the affected range to QTS 5.2.x and QuTS hero h5.2.x prior to 5.2.6.3195 build 20250715. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VA:L) and the independent CVSS 3.1 assessment agree that the administrator-account prerequisite is the dominant limiting factor; there is no confidentiality or integrity impact.
Know when Qts gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Network-reachable with low complexity but requires an administrator account (PR:H); only a DoS crash results, so C:N/I:N and A:L with unchanged scope.
Primary rating from Vendor (qnapsecurity).
CVSS VectorVendor: qnapsecurity
Lifecycle Timeline
3DescriptionCVE.org
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.
We have already fixed the vulnerability in the following versions: QTS 5.2.6.3195 build 20250715 and later QuTS hero h5.2.6.3195 build 20250715 and later
Executive ViewAI
Organizations using A NULL pointer dereference vulnerability should be aware of moderate risk from CVE-2025-52859, a null pointer dereference vulnerability rated CVSS 4.9. Exploitation could compromise the security of affected deployments. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: enable ASLR/DEP, apply network segmentation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
QNAP QTS before 4.2.4 Build 20170313 allows attackers to execute arbitrary commands via unspecified vectors. Rated criti
QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and obtain sensitive information
QNAP has patched a remote code execution vulnerability affecting the QTS Media Library in all versions prior to QTS 4.2.
QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and execute arbitrary commands vi
QNAP QTS before 4.2.4 Build 20170313 allows local users to obtain sensitive Domain Administrator password information by
This command injection vulnerability in QTS allows attackers to run arbitrary commands in the compromised application. R
This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. Rated criti
A prototype pollution vulnerability has been reported to affect several QNAP operating system versions. Rated high sever
A buffer overflow vulnerability in external device function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 2
A buffer overflow vulnerability in password function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117
GitHub PoC
Exploit-DB