QNAP QTS CVE-2025-66276

QTS is QNAP's primary NAS (network-attached storage) operating system, widely deployed on consumer and small-business storage appliances and typically exposed to LAN and occasionally WAN management interfaces. The CPE data confirms two QNAP product lines were initially in scope (qts and quts_hero), but the advisory clarifies that only QTS is vulnerable while QuTS hero (the ZFS-based sibling OS) is not, suggesting the defect lives in a QTS-specific component or code path. The vendor tag classifies this as Information Disclosure, but the upstream CWE was not published, so the precise weakness class (e.g., improper authorization, path traversal, missing authentication on an endpoint) cannot be confirmed from available data; the high CVSS v4.0 Confidentiality, Integrity, and Availability impact ratings (VC:H/VI:H/VA:H) are inconsistent with a pure read-only disclosure and hint at a broader compromise primitive than the Information Disclosure tag alone implies.