EUVD-2025-210100
GHSA-vpcm-92g9-vgwx
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (qnap) · only source for this CVE.
CVSS VectorVendor: qnap
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands.
We have already fixed the vulnerability in the following versions: QTS 5.2.9.3410 build 20260214 and later QuTS hero h5.2.9.3410 build 20260214 and later QuTS hero h5.3.4.3500 build 20260520 and later QuTS hero h6.0.0.3397 build 20260206 and later
AnalysisAI
Authenticated command injection in QNAP QTS and QuTS hero allows a remote attacker holding administrator credentials to execute arbitrary OS commands on the NAS appliance. The CVSS 4.0 base score of 8.6 reflects high impact across confidentiality, integrity, and availability, though exploitation requires high privileges (PR:H). No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV; QNAP has released fixed builds across affected QTS and QuTS hero branches.
Technical ContextAI
QTS and QuTS hero are QNAP's NAS operating systems used on consumer and SMB storage appliances; QuTS hero is the ZFS-based variant. The flaw maps to CWE-78 (Improper Neutralization of Special Elements used in an OS Command), meaning an administrative web/API interface passes attacker-controlled input into a shell or process invocation without adequate sanitization. CPE data identifies the affected products as cpe:2.3:a:qnap_systems_inc.:qts and cpe:2.3:a:qnap_systems_inc.:quts_hero across multiple branches (5.2, 5.3, and 6.0 lines of QuTS hero, plus QTS 5.2). Because NAS devices typically expose management interfaces over HTTP(S), successful injection runs in the context of the administrative service, which on QNAP appliances is typically high-privileged.
RemediationAI
Vendor-released patches are available: upgrade QTS to 5.2.9.3410 build 20260214 or later, QuTS hero h5.2 to h5.2.9.3410 build 20260214 or later, QuTS hero h5.3 to h5.3.4.3500 build 20260520 or later, and the QuTS hero 6.0 line to h6.0.0.3397 build 20260206 or later, following QNAP advisory https://www.qnap.com/en/security-advisory/qsa-26-10. Until firmware is applied, restrict reachability of the administrative web/API interface by binding it to a management VLAN or VPN and blocking inbound WAN access (trade-off: remote administration via myQNAPcloud or port-forwarded HTTPS will break), enforce strong unique passwords plus 2-step verification on every administrator account to make the PR:H requirement materially harder to satisfy, and rotate admin credentials if any exposure to untrusted networks has occurred. Disable or remove unused administrator accounts to shrink the attack surface, and review system event logs for unexpected admin logins or shell command execution as a detective control.
QNAP QTS before 4.2.4 Build 20170313 allows attackers to execute arbitrary commands via unspecified vectors. Rated criti
QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and obtain sensitive information
QNAP has patched a remote code execution vulnerability affecting the QTS Media Library in all versions prior to QTS 4.2.
QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and execute arbitrary commands vi
QNAP QTS before 4.2.4 Build 20170313 allows local users to obtain sensitive Domain Administrator password information by
This command injection vulnerability in QTS allows attackers to run arbitrary commands in the compromised application. R
This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. Rated criti
A prototype pollution vulnerability has been reported to affect several QNAP operating system versions. Rated high sever
A buffer overflow vulnerability in external device function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 2
A buffer overflow vulnerability in password function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117
A buffer overflow vulnerability in password function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117
A buffer overflow vulnerability in password function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today