QNAP QTS
CVE-2025-62848
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach QNAP service over network
-
DeliverySend crafted malformed request
-
ExploitTrigger NULL pointer dereference
-
ExecutionCrash service / appliance
-
ImpactDenial-of-service outage
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special configuration is required beyond network reachability to the vulnerable QNAP service: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates remote, unauthenticated exploitation against affected QTS 5.2.x and QuTS hero builds without user interaction. The primary limiting factor is network exposure of the affected service - appliances firewalled from untrusted networks are far less at risk - and the device must be running an unpatched build prior to QTS 5.2.7.3297 / QuTS hero h5.2.7.3297 / h5.3.1.3292 (build 20251024). Impact is limited to denial-of-service (crash), not code execution or data compromise based on the description. |
| Impact | This is a network-exploitable (CVSS 4.0 AV:N), low-complexity (AC:L), unauthenticated (PR:N) NULL pointer dereference (CWE-476) in QNAP QTS and QuTS hero, affecting a vendor-confirmed range of QTS 5.2.x builds. The vendor's CVSS 4.0 base score is 8.1, but this appears inflated: the vector claims full confidentiality and integrity impact (VC:H/VI:H), yet the description explicitly scopes the impact to denial-of-service only. A NULL pointer dereference of this type realistically causes a crash/availability loss (VA:H), not data disclosure or modification - treat the C/I impact as unverified and likely overstated. Exploitation maturity is Unproven per the vector's E:U metric, and there is no public exploit identified and no CISA KEV listing in the provided data, so there is no evidence of active exploitation. EPSS is not provided. Net assessment: a genuinely remotely reachable, pre-auth DoS against widely-deployed, often internet-exposed NAS appliances is operationally meaningful and should be patched promptly, but it is a lower priority than the 8.1 score implies because the only confirmed impact is availability, there is no known exploit, and the elevated C/I metrics conflict with the stated DoS-only effect - verify scope with QNAP advisory QSA-25-45. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a specially crafted request over the network to an internet-reachable or LAN-reachable QNAP NAS running an affected QTS/QuTS hero build, triggering a NULL pointer dereference in the vulnerable service. The resulting crash causes a denial-of-service, disrupting file storage and any services hosted on the appliance. No public exploit code has been identified and the vendor marks exploitation as Unproven, so this remains a theoretical-but-plausible scenario at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Denial-of-service through a NULL pointer dereference in QNAP QTS 5.2.x and QuTS hero allows remote, unauthenticated attackers to crash affected NAS services by sending crafted requests. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms network reachability and no authentication or user interaction are required; the independent assessment scores this as availability-only impact (CVSS 3.1 A:H), so exploitation results in service disruption rather than code execution or data compromise. No public exploit code has been identified at time of analysis, and EPSS/KEV data were not provided; the practical risk is driven almost entirely by whether the NAS management or service interfaces are exposed to untrusted networks. QNAP has released fixed builds, so unpatched, internet-facing appliances are the primary exposure.
RemediationAI
Apply the vendor-released patches: upgrade QTS to 5.2.7.3297 build 20251024 or later, or QuTS hero to h5.2.7.3297 build 20251024 or later, or QuTS hero to h5.3.1.3292 build 20251024 or later, following the instructions in QNAP advisory QSA-25-45 (https://www.qnap.com/en/security-advisory/qsa-25-45); firmware updates are delivered through the QTS/QuTS hero web administration interface under Control Panel, System, Firmware Update, and NAS administrators should verify the exact build string after rebooting because the fixed builds share the same date code across branches. Where patching must be deferred, the highest-value compensating control is removing network exposure: block inbound access to the NAS from the internet at the perimeter firewall and disable UPnP port forwarding so the appliance cannot open its own management ports - the trade-off is loss of direct remote access, which should be replaced with VPN or an authenticated reverse proxy. Restrict administrative and service ports to trusted management subnets, and use the QNAP Security Counselor to disable unused services and applications, accepting reduced functionality where those services are actually in use. Monitor NAS system logs for repeated process crashes or service restarts that could indicate exploitation attempts, and keep the appliance behind network segmentation since patched firmware remains the only complete fix.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a NULL pointer dereference (CWE-476) in QNAP's QTS and QuTS hero NAS operating systems. Root cause class is improper handling of an unexpected or missing pointer returned by an internal function - when a crafted network request drives the code path into a state where a pointer is never initialized or is explicitly set to NULL, the service dereferences it and terminates abnormally. CPE data pins the affected range to QTS 5.2.x releases, spanning from 5.2.0.2737 build 20240417 through 5.2.3.3006 build 20250108, with the corresponding QuTS hero branches (h5.2.x and h5.3.x) sharing the same code base vulnerability. Because QTS exposes numerous network services (web administration, file sharing, backup, and application portals) by default, a remotely reachable request is sufficient to trigger the dereference without credentials, making the vulnerable surface wide on any appliance not segmented behind a firewall. The impact is confined to availability - the affected process crashes, disrupting NAS services - consistent with CWE-476 as exploited here.
Know when Qts gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U
Remote unauthenticated low-complexity trigger (AV:N/AC:L/PR:N/UI:N); a NULL pointer dereference yields only a crash, so C:N/I:N and A:H.
Primary rating from Vendor (qnapsecurity).
CVSS VectorVendor: qnapsecurity
DescriptionCVE.org
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to launch a denial-of-service (DoS) attack.
We have already fixed the vulnerability in the following versions: QTS 5.2.7.3297 build 20251024 and later QuTS hero h5.2.7.3297 build 20251024 and later QuTS hero h5.3.1.3292 build 20251024 and later
Executive ViewAI
A denial-of-service flaw in QNAP QTS 5.2.x and QuTS hero lets any unauthenticated party on the network crash NAS services, potentially taking file sharing, backup targets, and any workloads hosted on those appliances offline without warning. Because exploitation requires neither credentials nor user interaction, the risk concentrates in internet-facing or broadly reachable NAS management and service interfaces, and repeated crashes could cause sustained storage and data-availability outages. No public exploit code has been identified at time of analysis, so exposure - not imminent attack activity - should drive prioritization.
No vendor-released patch version is identified in the provided data (the advisory text references fixed QNAP builds - confirm the exact build with QNAP before relying on it). Interim mitigations for unpatched appliances: block external access to QTS/QuTS hero management and service interfaces at the perimeter, restrict administrative reachability to trusted networks or VPN, disable unused services and ports, and monitor for unexpected NAS service restarts or crashes.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
QNAP QTS before 4.2.4 Build 20170313 allows attackers to execute arbitrary commands via unspecified vectors. Rated criti
QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and obtain sensitive information
QNAP has patched a remote code execution vulnerability affecting the QTS Media Library in all versions prior to QTS 4.2.
QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and execute arbitrary commands vi
QNAP QTS before 4.2.4 Build 20170313 allows local users to obtain sensitive Domain Administrator password information by
This command injection vulnerability in QTS allows attackers to run arbitrary commands in the compromised application. R
This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. Rated criti
A prototype pollution vulnerability has been reported to affect several QNAP operating system versions. Rated high sever
A buffer overflow vulnerability in external device function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 2
A buffer overflow vulnerability in password function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117
GitHub PoC
Exploit-DB