QNAP QTS CVE-2025-66281

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N confirms no special conditions - remote unauthenticated exploitation is possible against default network-accessible configurations of QNAP QTS and QuTS hero. No elevated privileges, user interaction, or non-default feature enablement is required. Exploitation is strictly limited to a denial-of-service outcome affecting availability (VA:L); there is no path to data access or system modification per VC:N/VI:N/SC:N/SI:N. Exploitation is limited in practice for devices that are not internet-exposed: placing the NAS behind a firewall or VPN that blocks unsolicited inbound connections to management and file-sharing ports eliminates the remote attack surface entirely. The specific network port, protocol, and service component that must be reachable are not disclosed in the advisory.

The CVSS 4.0 score of 6.9 (Medium) is driven by AV:N/AC:L/AT:N/PR:N/UI:N - fully network-accessible, low complexity, no authentication, and no user interaction - but is moderated by the impact subscores VC:N/VI:N/VA:L, which confirm no confidentiality or integrity impact and only a low availability impact. The 'Low' availability rating suggests partial or transient service disruption rather than persistent device failure or full OS crash. No EPSS data was provided, so exploitation probability beyond CVSS signals is unknown. This vulnerability is not in CISA KEV and no POC is identified. The primary real-world risk driver is QNAP's historically large internet-exposed device footprint - QNAP NAS units are routinely scanned and targeted, meaning even a moderate DoS flaw with no-auth network reach warrants prompt patching. The absence of any confidentiality or integrity impact means this is a pure availability concern and should be prioritized below critical RCE or data-exfiltration flaws, but above vulnerabilities requiring local or authenticated access.

An unauthenticated attacker on the internet identifies a QNAP NAS device with its management or file-sharing interface exposed, then sends a specially crafted network request that triggers the NULL pointer dereference in a vulnerable service. The targeted service crashes, rendering the NAS temporarily unavailable or disrupting file-sharing operations until the service restarts or the device is rebooted. No public POC code has been identified at time of analysis, but the low-complexity, no-authentication conditions mean this is straightforward to reproduce once the vulnerable request pattern is known.