EUVD-2025-32452Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain QNAP administrator credentials
-
ExploitAuthenticate to management interface
-
ExecutionSend crafted request triggering NULL deref
-
ImpactCrash service, cause denial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the attacker first hold a valid QNAP administrator account on the target device (PR:H) - this is the key limiting factor and is stated explicitly in the description ('If a remote attacker gains an administrator account'). The flaw affects QTS and QuTS hero 5.2.x branches prior to the 2025-07-15 fixed builds; devices already updated to QTS 5.2.6.3195 / QuTS hero h5.2.6.3195 (build 20250715) or later are not vulnerable. No user interaction is needed (UI:N) and the vector is network-reachable (AV:N), but the mandatory administrator privilege confines realistic exploitation to post-compromise or insider scenarios rather than opportunistic remote attack. |
| Impact | This is a genuinely low-priority issue despite a 'medium' CVSS 4.0 base score of 5.1. The decisive mitigating factor is PR:H: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L) and the description agree that the attacker must already possess a QNAP administrator account before triggering the NULL pointer dereference (CWE-476). The only impact is low availability (VA:L) - a denial of service - with no confidentiality or integrity impact (VC:N/VI:N). The signals are internally consistent rather than conflicting: EPSS is very low at 0.14% (34th percentile), there is no CISA KEV listing, and no public exploit code is referenced, all of which align with a low real-world threat. An authenticated-admin-only DoS offers little incentive to an attacker who, by definition, already controls the device. No SSVC decision record was provided in the input. Bottom line: a vendor-patched, self-reported, admin-gated DoS - real but low priority relative to unauthenticated or RCE-class QNAP flaws. |
| Exploit ScenarioDerived | An attacker who has already obtained QNAP administrator credentials (via prior compromise, credential reuse, or phishing) sends crafted input over the network to the management interface, triggering a NULL pointer dereference that crashes the affected service or device. No public exploit code is identified at time of analysis, and the attack yields only a denial of service - not code execution or data access. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 18, 2026
A NULL pointer dereference in QNAP QTS and QuTS hero 5.2.x allows an attacker who already holds a valid administrator account on the NAS to trigger a denial-of-service condition over the network, causing the affected service or system to crash. Because the CVSS vector requires high privileges (PR:H) and impact is limited to availability (A:L), the practical risk is confined to post-compromise or insider scenarios rather than opportunistic remote attack; EPSS is just 0.14% (34th percentile) and no public exploit or CISA KEV entry is associated with the flaw. QNAP has released fixed builds (QTS 5.2.6.3195 and QuTS hero h5.2.6.3195, build 20250715) that eliminate the vulnerability.
Earlier versions of this analysis (1)
RemediationAI
Upgrade to the vendor-released fixed builds: QTS 5.2.6.3195 build 20250715 or later, or QuTS hero h5.2.6.3195 build 20250715 or later, following the instructions in QNAP advisory QSA-25-36 (https://www.qnap.com/en/security-advisory/qsa-25-36). Because exploitation requires a valid administrator account, the most effective compensating control while patching is to enforce least privilege: restrict administrator group membership, remove unused admin accounts, enable MFA, and avoid exposing the NAS management interface directly to the internet (place it behind VPN or IP allow-listing). Trade-offs: tightening admin access and adding MFA increases login friction for legitimate administrators, and fronting the management UI with a VPN adds a dependency on the VPN concentrator's own availability and security. Where a firmware upgrade must be deferred, monitoring NAS service restarts and crash logs can detect attempted NULL-pointer DoS triggering, though it does not prevent the condition.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is classified as CWE-476 (NULL Pointer Dereference), a memory-safety flaw in which the affected QNAP firmware dereferences a pointer that has not been initialized or has been set to NULL, typically producing a crash, hang, or unexpected service termination. The affected code path is reachable over the network (AV:N) with no user interaction (UI:N), but only after the attacker has authenticated with administrative privileges (PR:H) per both the vendor's description and our independent assessment. The scope is unchanged (S:U) and only availability is impacted at a low level (A:L), with no confidentiality or integrity effect. The CPE inventory covers QTS 5.2.x builds from 5.2.0.2737 (April 2024) through 5.2.3.3006 (January 2025), and EUVD confirms both the QTS 5.2.x and QuTS hero h5.2.x branches below the 5.2.6.3195 / h5.2.6.3195 build 20250715 threshold are exposed. Exploitation requires an existing administrator session, meaning the flaw is primarily a post-authentication reliability/DoS weakness rather than an external attack surface.
Know when Qts gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Network-reachable management interface (AV:N/AC:L) but requires an administrator account (PR:H); only a DoS results, so A:L with C:N/I:N.
Primary rating from Vendor (qnapsecurity).
CVSS VectorVendor: qnapsecurity
Lifecycle Timeline
3DescriptionCVE.org
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.
We have already fixed the vulnerability in the following versions: QTS 5.2.6.3195 build 20250715 and later QuTS hero h5.2.6.3195 build 20250715 and later
Executive ViewAI
Organizations using A NULL pointer dereference vulnerability should be aware of moderate risk from CVE-2025-52860, a null pointer dereference vulnerability rated CVSS 4.9. Exploitation could compromise the security of affected deployments. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: enable ASLR/DEP, apply network segmentation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
QNAP QTS before 4.2.4 Build 20170313 allows attackers to execute arbitrary commands via unspecified vectors. Rated criti
QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and obtain sensitive information
QNAP has patched a remote code execution vulnerability affecting the QTS Media Library in all versions prior to QTS 4.2.
QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and execute arbitrary commands vi
QNAP QTS before 4.2.4 Build 20170313 allows local users to obtain sensitive Domain Administrator password information by
This command injection vulnerability in QTS allows attackers to run arbitrary commands in the compromised application. R
This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. Rated criti
A prototype pollution vulnerability has been reported to affect several QNAP operating system versions. Rated high sever
A buffer overflow vulnerability in external device function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 2
A buffer overflow vulnerability in password function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117
GitHub PoC
Exploit-DB