EUVD-2025-32441Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain QNAP administrator account
-
ExploitSubmit crafted format-string input remotely
-
ExecutionTrigger CWE-134 format string flaw
-
ImpactDisclose memory or corrupt process memory
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Format string safety
|
| Exploitation Conditions | Exploitation requires the attacker to already hold a QNAP administrator account on the device (CVSS PR:H) - this is the primary limiting factor and means the flaw is not exploitable by anonymous or low-privileged remote users. Once authenticated as admin, the attack is remote over the network (AV:N), requires low complexity (AC:L), and needs no user interaction (UI:N). Affected are QTS 5.2.x before 5.2.6.3195 build 20250715 and QuTS hero h5.2.x before h5.2.6.3195 build 20250715; patched builds are not vulnerable. The administrator-credential prerequisite substantially constrains realistic risk despite the network attack surface. |
| Impact | This is a moderate, lower-priority issue rather than an urgent threat. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N, score 5.1) requires PR:H - a pre-existing administrator account - which is a substantial barrier that gates the entire attack. EPSS is very low (0.05%, 16th percentile), there is no CISA KEV listing (not actively exploited), and no public exploit code is referenced, so all exploitation signals align toward low real-world urgency. A notable conflict exists between the description and the CVSS impact metrics: the description states an attacker can 'obtain secret data or modify memory' (implying confidentiality and integrity impact), yet the vendor vector sets VC:N/VI:N and only VA:L (availability) - this discrepancy should be verified with QNAP, as the scored impact may understate the actual confidentiality/integrity exposure of a CWE-134 format-string flaw. Because exploitation presupposes administrator access, the vulnerability is primarily a privilege/impact-escalation concern (e.g., memory disclosure or corruption beyond normal admin capabilities) rather than a remote compromise vector. |
| Exploit ScenarioDerived | An attacker who has already compromised or been granted a QNAP administrator account submits attacker-controlled input containing format-string specifiers to an affected management function over the network. The externally-controlled format string (CWE-134) is passed to a formatting routine, allowing the attacker to read adjacent memory (leaking secret data) or write to memory (corrupting process state). No public proof-of-concept is referenced in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 18, 2026
QNAP QTS and QuTS hero contain a format-string vulnerability that an attacker holding administrator credentials can exploit remotely to read sensitive data or modify memory. Affected are QTS 5.2.x before 5.2.6.3195 build 20250715 and QuTS hero h5.2.x before h5.2.6.3195 build 20250715; patched builds are not vulnerable. Risk is moderate because the administrator-account prerequisite limits exploitation, EPSS is 0.05%, and no public exploit or CISA KEV entry was identified at time of analysis.
Earlier versions of this analysis (1)
RemediationAI
Upgrade to QTS 5.2.6.3195 build 20250715 or later, or QuTS hero h5.2.6.3195 build 20250715 or later, per QNAP advisory QSA-25-36 (https://www.qnap.com/en/security-advisory/qsa-25-36). Because exploitation requires an existing administrator account, prioritize reducing that exposure: enforce strong unique admin credentials and MFA where supported, restrict management-interface access to trusted networks or VPN, and review administrator accounts for unnecessary privileges; these controls lower risk but can add login friction and require network changes. Monitor for suspicious admin activity and apply the vendor update promptly. No public exploit or KEV entry was identified at time of analysis, and EPSS is 0.05%, so this is a moderate-priority patching item rather than an emergency.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is CWE-134 (use of externally-controlled format string) in QNAP's NAS operating systems. QTS and QuTS hero pass attacker-influenced input into printf-family formatting routines without proper sanitization, so an administrator who can reach the vulnerable interface can supply format specifiers that cause unintended memory reads (disclosing secret data) or memory writes (corrupting memory). CPE data identifies affected QTS 5.2.0 through 5.2.3 builds, and EUVD confirms the affected range as QTS 5.2.x before 5.2.6.3195 build 20250715 and QuTS hero h5.2.x before h5.2.6.3195 build 20250715. The assessed CVSS 3.1 vector AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N shows the attack is network-reachable and low-complexity but requires high privileges (an existing QNAP administrator account), which is the main constraint.
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Network-reachable with low complexity but requires a pre-existing administrator account (PR:H); description indicates memory read and write, so C:L and I:L, with no scope change.
Primary rating from Vendor (qnapsecurity).
CVSS VectorVendor: qnapsecurity
Lifecycle Timeline
3DescriptionCVE.org
A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret data or modify memory.
We have already fixed the vulnerability in the following versions: QTS 5.2.6.3195 build 20250715 and later QuTS hero h5.2.6.3195 build 20250715 and later
Executive ViewAI
Organizations using A use of externally-controlled format string vulnerability should be aware of notable risk from CVE-2025-53406 rated CVSS 6.5. Exploitation could compromise the security of affected deployments. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
QNAP QTS before 4.2.4 Build 20170313 allows attackers to execute arbitrary commands via unspecified vectors. Rated criti
QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and obtain sensitive information
QNAP has patched a remote code execution vulnerability affecting the QTS Media Library in all versions prior to QTS 4.2.
QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and execute arbitrary commands vi
QNAP QTS before 4.2.4 Build 20170313 allows local users to obtain sensitive Domain Administrator password information by
This command injection vulnerability in QTS allows attackers to run arbitrary commands in the compromised application. R
This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. Rated criti
A prototype pollution vulnerability has been reported to affect several QNAP operating system versions. Rated high sever
A buffer overflow vulnerability in external device function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 2
A buffer overflow vulnerability in password function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117
GitHub PoC
Exploit-DB