QNAP QTS CVE-2025-62849

The CVSS 4.0 vector sets PR:N (no authentication required) and AV:N (network-reachable), but exploitation is explicitly gated by AT:P (specific attack requirements/preconditions must hold on the target) and UI:P (passive user interaction by a legitimate user is needed), so it is not guaranteed against an arbitrary default deployment. The vulnerability affects QNAP QTS 5.2.0.x through 5.2.3.3006 and corresponding QuTS hero builds prior to the fixed releases; the specific SQL-injectable feature or endpoint is not identified in the available data and should be confirmed with QNAP advisory QSA-25-45. Practical limiting factors: the appliance's management interface must be network-reachable (internet-exposed NAS are highest risk), the undisclosed attack precondition must be satisfied, and some user interaction is required - these reduce real-world exploitability well below what an unauthenticated network vector alone would suggest.

This is a moderate-priority issue rather than a critical emergency, and the signals are largely consistent. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H) scores only 5.2 despite high confidentiality/integrity/availability impact, because the Attack Requirements (AT:P) and passive User Interaction (UI:P) metrics materially constrain exploitability - a network-reachable, unauthenticated path exists, but specific preconditions and some user involvement are needed. EPSS is low at 0.97% (61st percentile), indicating a modest modeled probability of exploitation in the near term, and the CVSS 4.0 Exploit Maturity is explicitly E:U (unreported/unproven). There is no CISA KEV listing and no public POC, so exploitation status is: no public exploit identified at time of analysis. The one notable tension is CWE-89 SQL injection combined with a description claiming attackers can 'execute unauthorized code or commands' - SQLi-to-command-execution is plausible on NAS firmware but is a strong claim the vendor advisory does not detail; verify the exact impact path with QNAP. Overall: a genuinely patch-worthy flaw in internet-facing NAS appliances, but currently neither actively exploited nor trivially weaponizable, so it warrants prompt patching rather than crisis response.

A remote attacker reachable over the network sends a crafted request containing malicious SQL to a vulnerable QTS/QuTS hero management interface, and - given the required preconditions and some passive user interaction - the injected query manipulates the backend database to run unauthorized commands on the appliance. No public exploit code is currently available, and the CVSS 4.0 Attack Requirements (AT:P) and passive User Interaction (UI:P) metrics mean exploitation is not fully turnkey against an arbitrary default target.