EUVD-2025-32435Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain QNAP administrator account
-
ExploitSend crafted request over network
-
ExecutionTrigger NULL pointer dereference
-
ImpactCrash service (denial of service)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already possess a QNAP administrator account on the target device - the description explicitly states 'If a remote attacker gains an administrator account.' This high-privilege prerequisite (reflected as PR:H) is the primary limiting factor and sharply narrows the realistic threat to insiders, credential-theft scenarios, or chaining with a separate authentication-bypass flaw. Affected deployments are QTS 5.2.x prior to 5.2.6.3195 build 20250715 and QuTS hero h5.2.x prior to h5.2.6.3195 build 20250715; patched builds are not vulnerable. Impact is limited to denial of service (availability); no user interaction is required once admin access is held. |
| Impact | This is a genuinely low-priority issue despite a 'medium' CVSS 4.0 base score of 5.1. All signals converge on low real-world risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N) requires high privileges - specifically an administrator account per the description - and the only impact is limited availability (VA:L) with no confidentiality or integrity impact and no scope/subsequent-system effect. EPSS is 0.14% (34th percentile), indicating very low likelihood of exploitation, which is fully consistent with the high privilege barrier. There is no CISA KEV listing and no public exploit identified at time of analysis, so there is no public exploit identified at time of analysis. The core mitigating factor is the PR:H requirement: an attacker who already holds a QNAP administrator account can crash the service, but an administrator can typically reboot or disrupt the device through legitimate means anyway, making the marginal attacker advantage small. No signals conflict; CWE-476 (NULL pointer dereference) causing DoS aligns cleanly with the VA:L-only impact. Patch is confirmed available from the vendor. |
| Exploit ScenarioDerived | An attacker who has already compromised or legitimately obtained QNAP administrator credentials sends a crafted request over the network that triggers a NULL pointer dereference (CWE-476), crashing the affected service or device and causing a denial of service. No public exploit code is identified, and exploitation is gated behind administrator-level authentication, so impact is limited to availability disruption of an already-controlled device. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 18, 2026
A NULL pointer dereference in QNAP QTS and QuTS hero 5.2.x (prior to builds 5.2.6.3195 / h5.2.6.3195 of 20250715) allows a remote attacker who already holds a QNAP administrator account to crash or destabilize the device, producing a denial-of-service condition limited to availability impact. The PR:H prerequisite is the dominant limiting factor: only insiders, credential thieves, or attackers chaining a separate authentication bypass can reach the flaw, and no public exploit code or active exploitation (CISA KEV) is associated with it. EPSS is 0.14% (34th percentile), and the vendor has released fixed builds, making this a low-priority, patching-hygiene issue rather than an urgent exposure.
Earlier versions of this analysis (1)
RemediationAI
Upgrade to QTS 5.2.6.3195 build 20250715 or later, or QuTS hero h5.2.6.3195 build 20250715 or later, as documented in QNAP advisory QSA-25-36 (https://www.qnap.com/en/security-advisory/qsa-25-36); this is the vendor-released patch and fully removes the flaw. Until upgrading, reduce the prerequisite exposure rather than the bug itself: restrict administrative access to the NAS management interface via firewall rules or an allow-list of trusted management hosts, and disable or block remote admin exposure (e.g., myQNAPcloud admin access and WAN-facing management ports) - the trade-off is loss of convenient remote administration. Enforce least-privilege and unique admin credentials and enable MFA/account lockout to make the required administrator account harder to obtain, since the flaw is only exploitable post-authentication; note that these are compensating controls and do not fix the underlying NULL dereference. Monitor for unexpected service crashes or restarts as an indicator of attempted abuse. No public exploit code is known, and no workaround beyond access restriction is documented by the vendor.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a CWE-476 NULL pointer dereference in QNAP's QTS and QuTS hero NAS operating systems. A dereference of an unvalidated null pointer in a remotely reachable administrative code path causes the affected process or service to fault, producing a denial-of-service condition rather than memory corruption that could yield code execution. CVSS 4.0 scores the flaw 5.1 (AV:N/AC:L/AT:N/PR:H/UI:N/VA:L), and the independent CVSS 3.1 assessment (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L) agrees: no confidentiality or integrity impact, low availability impact, and a high-privilege prerequisite. CPE data pins affected builds to the QTS 5.2.0.x through 5.2.3.x series (e.g., 5.2.0.2737 build 20240417 through 5.2.3.3006 build 20250108), with EUVD extending the range to QTS 5.2.x below 5.2.6.3195 build 20250715 and QuTS hero h5.2.x below h5.2.6.3195 build 20250715. Because the crash path is only reachable post-authentication as an administrator, the practical attack surface is the management interface of unpatched NAS appliances.
Know when Qts gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Network-reachable (AV:N) and low complexity (AC:L), but requires an administrator account so PR:H; only a partial availability crash (A:L) with no confidentiality or integrity impact.
Primary rating from Vendor (qnapsecurity).
CVSS VectorVendor: qnapsecurity
Lifecycle Timeline
3DescriptionCVE.org
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.
We have already fixed the vulnerability in the following versions: QTS 5.2.6.3195 build 20250715 and later QuTS hero h5.2.6.3195 build 20250715 and later
Executive ViewAI
Organizations using A NULL pointer dereference vulnerability should be aware of moderate risk from CVE-2025-52857, a null pointer dereference vulnerability rated CVSS 4.9. Exploitation could compromise the security of affected deployments. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: enable ASLR/DEP, apply network segmentation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
QNAP QTS before 4.2.4 Build 20170313 allows attackers to execute arbitrary commands via unspecified vectors. Rated criti
QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and obtain sensitive information
QNAP has patched a remote code execution vulnerability affecting the QTS Media Library in all versions prior to QTS 4.2.
QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and execute arbitrary commands vi
QNAP QTS before 4.2.4 Build 20170313 allows local users to obtain sensitive Domain Administrator password information by
This command injection vulnerability in QTS allows attackers to run arbitrary commands in the compromised application. R
This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. Rated criti
A prototype pollution vulnerability has been reported to affect several QNAP operating system versions. Rated high sever
A buffer overflow vulnerability in external device function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 2
A buffer overflow vulnerability in password function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117
GitHub PoC
Exploit-DB