QNAP NAS CVE-2025-59382

Active user interaction (UI:A in CVSS 4.0) is a hard prerequisite - the attack cannot be delivered without a targeted user clicking a crafted link or submitting a manipulated request. The vulnerability is network-accessible (AV:N) with no authentication required (PR:N) and low complexity (AC:L), meaning the attacker does not need an existing account or special network position. The specific QNAP web parameter(s) susceptible to external control are not named in the available data; consult QSA-26-10 for the exact feature or endpoint. Exploitation is limited to low integrity impact with no confidentiality or availability consequence per the CVSS vector. The scope contradiction in source data (description denies QTS/QuTS hero/QuTScloud are affected while CPE asserts they are) introduces uncertainty about whether a particular deployment is actually exposed - this must be resolved with the vendor.

The CVSS 4.0 base score of 5.1 (Medium) is consistent with the limited impact profile: no confidentiality loss (VC:N), low integrity impact (VI:L), no availability impact, and no scope change to subsequent systems (SC:N/SI:N/SA:N). User interaction (UI:A) is a meaningful exploitation barrier that prevents fully automated, mass exploitation. No EPSS score was provided in the input data, so probabilistic exploitation likelihood cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, and no public proof-of-concept exploit has been identified. The 'Information Disclosure' tag from the source is in tension with the CVSS showing VC:N - either the tag reflects a secondary or nuanced disclosure path not captured in the vector, or it may be a tagging error; this should be verified against the full vendor advisory. A critical data quality issue is present: the description and CPE data directly contradict each other regarding which products are affected. Until this is resolved via the vendor advisory at qsa-26-10, defenders cannot confidently confirm or exclude specific product lines from their exposure assessment.

An attacker hosts a malicious web page or crafted link containing manipulated, seemingly immutable parameters targeting the QNAP web interface. A logged-in or otherwise active QNAP user is socially engineered into clicking the link or submitting a crafted form, causing the application to process the attacker-controlled parameter values as trusted. This results in low-level unauthorized modification of application state or data integrity on the NAS device. No public exploit code has been identified at time of analysis.