EUVD-2025-210101
GHSA-25q9-p4j4-6rj7
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (qnap) · only source for this CVE.
CVSS VectorVendor: qnap
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
An integer overflow or wraparound vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system.
We have already fixed the vulnerability in the following versions: QTS 5.2.9.3410 build 20260214 and later QuTS hero h5.2.9.3410 build 20260214 and later QuTS hero h5.3.4.3500 build 20260520 and later QuTS hero h6.0.0.3397 build 20260206 and later
AnalysisAI
Integer overflow (CWE-190) in QNAP QTS and QuTS hero NAS operating systems allows a remote attacker who has already obtained an administrator account to further compromise system integrity and availability. Affected versions span QTS 5.2.x and QuTS hero h5.2.x through h6.0.x; QNAP released patched builds in February and May 2026. No public exploit code and no CISA KEV listing have been identified at time of analysis, and the mandatory prerequisite of administrator-level access materially constrains real-world exploitability.
Technical ContextAI
The vulnerability is classified as CWE-190 (Integer Overflow or Wraparound), a class of memory-corruption bugs where arithmetic on integer values exceeds the type's storage bounds, producing unexpected values that can corrupt heap or stack memory, bypass length checks, or trigger out-of-bounds writes. It affects two QNAP NAS operating system product lines: QTS (CPE cpe:2.3:a:qnap_systems_inc.:qts) and QuTS hero (CPE cpe:2.3:a:qnap_systems_inc.:quts_hero). QuTS hero is QNAP's ZFS-based enterprise NAS OS, while QTS is the standard NAS platform. Tags in the intelligence data also flag 'Buffer Overflow', suggesting the integer overflow can be chained into a buffer overflow condition - a common secondary effect of CWE-190 - which would explain the integrity and availability impacts reflected in the CVSS vector.
RemediationAI
The primary fix is to upgrade to one of QNAP's patched releases: QTS 5.2.9.3410 build 20260214 or later, QuTS hero h5.2.9.3410 build 20260214 or later, QuTS hero h5.3.4.3500 build 20260520 or later, or QuTS hero h6.0.0.3397 build 20260206 or later. Updates are available through the QNAP QTS/QuTS hero control panel under System > Firmware Update or via the QNAP advisory at https://www.qnap.com/en/security-advisory/qsa-26-10. As a compensating control, organizations should enforce the principle of least privilege on QNAP administrator accounts and disable remote administrator access (HTTPS/SSH) from untrusted networks or the public internet, since exploitation requires an administrator credential - eliminating exposure of admin interfaces to external networks removes the network vector entirely. Enabling two-factor authentication on administrator accounts raises the bar for credential compromise, which is the prerequisite step. Side effect of restricting remote admin access: legitimate remote management workflows will require VPN or jump-host access instead.
QNAP QTS before 4.2.4 Build 20170313 allows attackers to execute arbitrary commands via unspecified vectors. Rated criti
QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and obtain sensitive information
QNAP has patched a remote code execution vulnerability affecting the QTS Media Library in all versions prior to QTS 4.2.
QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and execute arbitrary commands vi
QNAP QTS before 4.2.4 Build 20170313 allows local users to obtain sensitive Domain Administrator password information by
This command injection vulnerability in QTS allows attackers to run arbitrary commands in the compromised application. R
This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. Rated criti
A prototype pollution vulnerability has been reported to affect several QNAP operating system versions. Rated high sever
A buffer overflow vulnerability in external device function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 2
A buffer overflow vulnerability in password function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117
A buffer overflow vulnerability in password function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117
A buffer overflow vulnerability in password function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Integer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today