QNAP QTS CVE-2025-66279

Exploitation requires valid QNAP administrator credentials on a vulnerable QTS or QuTS hero build (PR:H in the CVSS 4.0 vector) and network reachability to the appliance's administrative web/API interface; no user interaction is required (UI:N) and attack complexity is low (AC:L/AT:N). Limiting factors that reduce real-world risk: the admin account requirement excludes anonymous internet scanners, devices behind 2-step verification raise the bar further, and appliances whose management interface is restricted to LAN/VPN are not remotely reachable. The vulnerable surface is the QNAP NAS management plane on the firmware versions enumerated in the EUVD record; appliances already on QTS 5.2.9.3410 build 20260214, QuTS hero h5.2.9.3410 build 20260214, h5.3.4.3500 build 20260520, or h6.0.0.3397 build 20260206 or later are not exposed.

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:H/UI:N indicates network-reachable, low-complexity exploitation with no user interaction, but explicitly requires administrator privileges, which sharply narrows the realistic attacker population to insiders, credential thieves, or chained post-auth bypasses. There is no EPSS score, no SSVC determination, and no KEV listing in the supplied data, and no public exploit has been identified at time of analysis, so this is not currently a mass-exploitation candidate. However, QNAP NAS devices have a strong history of being internet-exposed and targeted by ransomware actors who routinely pair credential abuse with post-auth command injection, so the practical risk is materially higher for any appliance whose admin panel is reachable from untrusted networks. No conflicting signals are present in the supplied data; the main missing inputs are EPSS, POC availability, and any independent confirmation of in-the-wild use.

An attacker who has phished, brute-forced, or reused leaked credentials to obtain a QNAP administrator account logs into the QTS or QuTS hero web interface over the network and submits a crafted value to a management endpoint that passes input into a shell command. The injected payload executes as the privileged management process, allowing the attacker to deploy ransomware, exfiltrate stored data, install persistent backdoors, or pivot into the LAN; no public exploit has been identified at time of analysis, but the bug class is well understood and trivially weaponizable once credentials are in hand.