QNAP QTS CVE-2025-66276

No authentication or user interaction is required (PR:N/UI:N) and the attack is launched over the network (AV:N) against QTS versions 5.2.0 up to but not including 5.2.7.3256 build 20250913, so any reachable, unpatched QTS appliance in that version range is in scope. Exploitation is LIMITED by three factors visible in the available data: (1) the CVSS v4.0 AT:P flag indicates a non-default attack requirement or specific runtime condition must hold on the target (the QNAP advisory text was not provided in input, so the exact precondition cannot be named from this data and should be confirmed against QSA-25-56); (2) QuTS hero NAS units are explicitly not affected, so deployments on that OS family are out of scope; and (3) practical reachability depends on whether the QTS management interface is exposed to the attacker's network - devices behind NAT without port-forwarding and without myQNAPcloud relay enabled are substantially harder to reach from the internet.

Risk is elevated by the CVSS v4.0 vector showing network-reachable, low-complexity, unauthenticated exploitation with high impact across confidentiality, integrity, and availability of the vulnerable component, producing a 9.2 base score. However, several mitigating signals warrant caution: the vector includes AT:P (attack requirements: present), meaning some non-default condition or context must be satisfied beyond a vanilla network reach, which lowers practical exploitability versus a pure 'point and shoot' RCE. EPSS data was not provided in the input, so probability of imminent exploitation cannot be quantified; the vulnerability is not in CISA KEV and no public exploit was identified, so this is not yet confirmed actively exploited. There is also tension between the vendor-applied Information Disclosure tag and the high VI/VA impacts in the CVSS vector - defenders should not assume read-only impact and should verify with QNAP advisory QSA-25-56 before deprioritizing. QNAP NAS devices have a strong history of mass exploitation by ransomware crews (DeadBolt, Qlocker, etc.), so any unauthenticated, network-reachable QTS flaw should be patched promptly even absent KEV listing.

An attacker who can reach a QNAP NAS web management interface - either across the LAN on a compromised network or against an internet-exposed device discovered via Shodan/Censys scans for QTS login pages - sends a crafted network request to the vulnerable QTS component without supplying credentials. Because the CVSS vector requires no privileges or user interaction but does flag AT:P, the attacker may need the target device to be in a specific QTS-supported configuration or running an affected service; once triggered, the flaw yields high-impact access to data on the appliance. No public exploit identified at time of analysis, but QNAP NAS vulnerabilities are routinely weaponized by ransomware operators within weeks of disclosure, so opportunistic mass scanning is the realistic threat model.