QNAP QTS
CVE-2025-62847
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach QNAP NAS over network
-
ExploitSubmit crafted request with argument delimiters
-
ExecutionArgument injection bypasses command neutralization
-
ImpactAlter command execution logic
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Argument sanitization
|
| Exploitation Conditions | The target must run an affected QNAP OS build: QTS 5.2.x prior to 5.2.7.3297 build 20251024, or QuTS hero prior to h5.2.7.3297 / h5.3.1.3292 build 20251024, and the vulnerable command-handling interface must be network-reachable. Per the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) no authentication, no user interaction, and no special attack requirement are needed, so exploitation works against reachable default-configuration devices; the practical limiting factor is network exposure of the affected service (internet-facing NAS are at highest risk) and the vendor has not published the exact component/endpoint, so the specific feature that must be enabled cannot be confirmed from available data. Impact is bounded to altering execution logic (integrity), not data disclosure or denial of service. |
| Impact | This is a medium-severity (CVSS 4.0 base 6.6) argument-injection flaw (CWE-88) in QNAP's QTS and QuTS hero NAS operating systems. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated vector with no user interaction, but impact is confined to integrity (VI:H) with no confidentiality (VC:N) or availability (VA:N) effect - consistent with the description's 'alter execution logic' rather than data theft or disruption. Signals are mostly aligned toward moderate rather than top priority: EPSS is low at 0.82% (56th percentile), the CVE is NOT on CISA KEV, and no public proof-of-concept is referenced, so there is no public exploit identified at time of analysis. The main amplifier of risk is that QNAP NAS appliances are frequently internet-exposed and have a strong history of mass exploitation, so even a medium-scored unauthenticated integrity flaw warrants prompt patching. CONFLICT TO NOTE: the input 'Information Disclosure' tag contradicts the CVSS vector, which sets VC:N (no confidentiality impact) and VI:H (integrity impact) - the tag appears mislabeled and should not drive a confidentiality-focused response; verify intended impact with QNAP advisory QSA-25-45. |
| Exploit ScenarioDerived | A remote attacker sends a crafted request to an internet-exposed or network-reachable QNAP NAS running an affected QTS/QuTS hero build, embedding argument delimiters that the vulnerable component fails to neutralize before building a system command. By injecting additional arguments, the attacker alters the intended execution logic of that command to change device behavior. No public exploit code is identified at time of analysis, and per CVSS the impact is limited to integrity (VI:H), not data disclosure or availability loss. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Unauthenticated remote argument injection (CWE-88) in QNAP's QTS and QuTS hero NAS operating systems lets attackers alter command execution logic on reachable devices, yielding a high-integrity-loss but no-confidentiality or availability impact. Affected builds are QTS 5.2.x prior to 5.2.7.3297 build 20251024 and QuTS hero prior to h5.2.7.3297 / h5.3.1.3292 build 20251024; per the CVSS 4.0 vector, no privileges, user interaction, or special conditions are required, making internet-exposed NAS the highest-risk deployments. No public exploit code has been identified at time of analysis and the flaw is not in CISA KEV; EPSS is 0.82% (56th percentile), indicating low but non-trivial predicted exploitation activity.
RemediationAI
Vendor-released patch: QTS 5.2.7.3297 build 20251024 and later, QuTS hero h5.2.7.3297 build 20251024 and later (5.2.x branch), and QuTS hero h5.3.1.3292 build 20251024 and later (5.3.x branch); upgrade via QTS/QuTS hero firmware update in the NAS web console or Qfinder Pro, and consult QSA-25-45 (https://www.qnap.com/en/security-advisory/qsa-25-45) for the authoritative build matrix. Because the vendor has not published the specific component or endpoint, no targeted disable is possible; the effective compensating control is exposure reduction - remove port-forwarding/UPnP rules that publish NAS management or web services to the internet, disable myQNAPcloud remote access where it is not operationally required, and restrict access to trusted management VLANs or a VPN, accepting the trade-off that remote administrative access becomes dependent on the VPN gateway. Placing the NAS behind a reverse proxy or WAF with strict argument/parameter allow-listing can reduce exposure but is heuristic given the undisclosed attack surface, and it may break legitimate application parameters. Until patched, monitor QTS/QuTS hero logs for anomalous command or CGI invocation patterns; patching remains the only complete fix since the flaw is logic-level and cannot be reliably mitigated by signature filtering alone.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-88, Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'): untrusted input is passed into a command invocation without stripping argument delimiters (spaces, hyphens, '--' style flags), so an attacker can supply tokens that are interpreted as program options rather than as inert data. This differs from classic shell metacharacter injection (CWE-78) in that the attacker typically cannot spawn arbitrary commands, but can change which flags, files, or operational modes the underlying utility executes - which matches the vendor's description of being able to 'alter execution logic'. Argument-injection bugs most often surface in wrapper scripts or IPC/RPC handlers that forward parameters to system utilities, and the mirrored fixes across QTS 5.2.7.3297 and QuTS hero h5.2.7.3297 on the same build date indicate a shared codebase component rather than a product-specific one. The CPE data enumerates affected QTS builds from 5.2.0.2737 (2024-04-17) through 5.2.3.3006 (2025-01-08), confirming the issue was present across the entire 5.2.x maintenance stream. The vendor advisory does not disclose the exact component, endpoint, or the utility being invoked, so the precise attack surface cannot be confirmed from available data; the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N) confirms this is a network-reachable, unauthenticated integrity-only issue, consistent with the independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). Note that the accompanying metadata tag 'Information Disclosure' is not supported by either vector, which both assign C:N.
Know when Qts gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U
Honoring the vendor vector: network-reachable and low-complexity with no auth or interaction (AV:N/AC:L/PR:N/UI:N); argument injection alters execution logic so integrity-only (I:H, C:N, A:N).
Primary rating from Vendor (qnapsecurity).
CVSS VectorVendor: qnapsecurity
DescriptionCVE.org
An improper neutralization of argument delimiters in a command vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to alter execution logic.
We have already fixed the vulnerability in the following versions: QTS 5.2.7.3297 build 20251024 and later QuTS hero h5.2.7.3297 build 20251024 and later QuTS hero h5.3.1.3292 build 20251024 and later
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Affected Products (CPE)CVE.org
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
QNAP QTS before 4.2.4 Build 20170313 allows attackers to execute arbitrary commands via unspecified vectors. Rated criti
QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and obtain sensitive information
QNAP has patched a remote code execution vulnerability affecting the QTS Media Library in all versions prior to QTS 4.2.
QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and execute arbitrary commands vi
QNAP QTS before 4.2.4 Build 20170313 allows local users to obtain sensitive Domain Administrator password information by
This command injection vulnerability in QTS allows attackers to run arbitrary commands in the compromised application. R
This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. Rated criti
A prototype pollution vulnerability has been reported to affect several QNAP operating system versions. Rated high sever
A buffer overflow vulnerability in external device function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 2
A buffer overflow vulnerability in password function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117
GitHub PoC
Exploit-DB