QNAP MARS CVE-2025-59387

Exploitation requires network reachability to a QNAP device running the MARS (Multi-Application Recovery Service) component on a version prior to 1.2.1.1686. Per the CVSS vector (PR:N/UI:N), no authentication or user interaction is required, so default network-exposed deployments are at risk. The primary limiting factor is deployment footprint rather than configuration: MARS must be installed/enabled and its network interface reachable by the attacker - devices where MARS is not deployed or where the service is not exposed to the attacker's network are not affected. Applying firmware/app version 1.2.1.1686 or later remediates the flaw.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated SQL injection requiring no user interaction, with high confidentiality, integrity, and availability impact on the vulnerable system (VC:H/VI:H/VA:H) and no scope change (SC:N/SI:N/SA:N), yielding a base score of 8.1 (High). These signals are internally consistent - an unauthenticated remote SQLi is exactly the profile a network-vector/no-privileges vector describes. However, the exploitation-readiness signals temper the urgency: EPSS is only 0.16% (36th percentile), there is no CISA KEV listing and no public exploit code identified at time of analysis, so this is currently a theoretically serious but not actively-exploited issue. The embedded 4.0 threat metric E:U (Exploit Unproven) aligns with the low EPSS, reinforcing that no weaponized exploit is known. Net assessment: treat as a genuine high-priority patch target because the pre-conditions for mass exploitation are minimal (no auth, no UI), but there is no evidence of in-the-wild activity yet - prioritize based on whether MARS is network-exposed. One caveat: the description is terse ('execute unauthorized code or commands') and does not confirm the mechanism by which SQLi escalates to code/command execution, so the VA:H/VI:H claims rely on the vendor's own scoring rather than independent technical detail.

A remote attacker with network access to a QNAP device running MARS sends a crafted request containing malicious SQL to an injectable parameter, which the application concatenates into a database query without sanitization. Because no authentication or user interaction is required, the attacker can read or modify backend data and, per the vendor, leverage the injection to execute unauthorized code or commands. No public proof-of-concept or exploit code has been identified at time of analysis.