EUVD-2025-210102
GHSA-hjv6-9pr5-j6w8
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (qnap) · only source for this CVE.
CVSS VectorVendor: qnap
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to launch a denial-of-service (DoS) attack.
We have already fixed the vulnerability in the following versions: QTS 5.2.9.3410 build 20260214 and later QuTS hero h5.2.9.3410 build 20260214 and later QuTS hero h5.3.4.3500 build 20260520 and later QuTS hero h6.0.0.3397 build 20260206 and later
AnalysisAI
NULL pointer dereference in QNAP QTS and QuTS hero NAS operating systems allows remote unauthenticated attackers to crash a network-facing service and cause a denial-of-service condition without any authentication or user interaction. Multiple active OS branches are affected - QTS 5.2.x and QuTS hero h5.2.x through h6.0.x - across a device population that is historically internet-exposed and frequently targeted. No public exploit has been identified and this vulnerability is not listed in CISA KEV, but the zero-authentication, network-accessible attack surface makes DoS attempts trivially repeatable against unpatched devices.
Technical ContextAI
CWE-476 (NULL Pointer Dereference) describes a class of memory safety defect where code attempts to dereference a pointer that has not been validated as non-null, causing an immediate process or kernel crash. QNAP QTS is a Linux-based NAS operating system used across QNAP's consumer and SMB storage product lines; QuTS hero is a variant that uses a ZFS-based storage layer rather than the traditional ext4 stack of QTS. Both are confirmed affected per CPE strings cpe:2.3:a:qnap_systems_inc.:qts:*:*:*:*:*:*:*:* and cpe:2.3:a:qnap_systems_inc.:quts_hero:*:*:*:*:*:*:*:*. The advisory does not disclose which specific daemon, API handler, or protocol triggers the null dereference - only that the flaw is reachable over the network without authentication, implying it resides in a network-facing service such as the web management interface or a storage/file-sharing protocol handler.
RemediationAI
QNAP has released vendor-confirmed patches across all affected branches: upgrade QTS to 5.2.9.3410 build 20260214 or later; upgrade QuTS hero to h5.2.9.3410 build 20260214, h5.3.4.3500 build 20260520, or h6.0.0.3397 build 20260206 (or later) depending on the installed branch. Updates can be applied through Control Panel > System > Firmware Update within the QTS or QuTS hero interface, or via the myQNAPcloud update mechanism. The full vendor advisory with update links is at https://www.qnap.com/en/security-advisory/qsa-26-10. If immediate patching is not feasible, restrict network access to the NAS management interface by disabling internet-facing exposure - specifically, disable UPnP port forwarding, disable myQNAPcloud direct connect, and apply firewall rules limiting access to management ports (typically 8080/443) to trusted internal subnets only. This reduces attack surface but will break remote access functionality for legitimate users.
QNAP QTS before 4.2.4 Build 20170313 allows attackers to execute arbitrary commands via unspecified vectors. Rated criti
QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and obtain sensitive information
QNAP has patched a remote code execution vulnerability affecting the QTS Media Library in all versions prior to QTS 4.2.
QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and execute arbitrary commands vi
QNAP QTS before 4.2.4 Build 20170313 allows local users to obtain sensitive Domain Administrator password information by
This command injection vulnerability in QTS allows attackers to run arbitrary commands in the compromised application. R
This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. Rated criti
A prototype pollution vulnerability has been reported to affect several QNAP operating system versions. Rated high sever
A buffer overflow vulnerability in external device function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 2
A buffer overflow vulnerability in password function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117
A buffer overflow vulnerability in password function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117
A buffer overflow vulnerability in password function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today