EUVD-2025-32439Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain administrator account on QNAP NAS
-
ExploitSend crafted request over network
-
ExecutionTrigger NULL pointer dereference (CWE-476)
-
ImpactCrash service, cause denial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already possess a valid QNAP administrator account on the target device (PR:H) - this is the dominant limiting factor and means the flaw is only reachable post-authentication by a privileged user. The attack is network-reachable (AV:N) with low complexity (AC:L) and no user interaction, but only against QTS and QuTS hero versions prior to the fixed builds (QTS 5.2.6.3195 build 20250715 / QuTS hero h5.2.6.3195 build 20250715). Impact is confined to denial of service (availability only); no confidentiality or integrity compromise is possible through this vulnerability. |
| Impact | This is a low-priority issue despite its MEDIUM CVSS 4.0 score of 5.1. The signals are consistent and all point toward low real-world risk: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N) shows network reachability and low attack complexity, but PR:H means the attacker must already hold an administrator account - a very high barrier. Impact is limited to availability (VA:L) with no confidentiality or integrity effect and no scope change, so the worst outcome is a denial-of-service of a service already under the attacker's administrative control. EPSS is 0.14% (34th percentile), indicating low predicted exploitation likelihood, and this CVE is NOT in CISA KEV and has no public exploit identified at time of analysis - so there are no conflicting signals inflating the risk. The practical concern is minimal because an attacker who already possesses NAS administrator credentials has far more damaging options (data access, configuration tampering) than crashing a service. No data is conflicting here; the only nuance is that CWE-476 (NULL pointer dereference) aligns cleanly with the availability-only impact. |
| Exploit ScenarioDerived | An attacker who has already compromised or legitimately holds a QNAP administrator account sends a crafted request over the network to a vulnerable QTS or QuTS hero device, triggering a NULL pointer dereference that crashes the affected service and causes a denial of service. No public exploit code has been identified, and the prerequisite administrator access makes this a post-authentication reliability flaw rather than an initial-access vector. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 18, 2026
Denial of service in QNAP QTS and QuTS hero 5.2.x allows a remote attacker who already holds a valid administrator account to crash affected NAS systems by triggering a NULL pointer dereference. The issue is network-reachable with low attack complexity but is gated by the high-privilege requirement, so only authenticated administrative users can exploit it, and impact is limited to availability. QNAP has released fixed builds and no public exploit or active exploitation is identified at time of analysis; EPSS is 0.14% (34th percentile), consistent with low observed risk.
Earlier versions of this analysis (1)
RemediationAI
Upgrade QTS to 5.2.6.3195 build 20250715 or later and QuTS hero to h5.2.6.3195 build 20250715 or later; this is the vendor-released patch documented in QNAP QSA-25-36 at https://www.qnap.com/en/security-advisory/qsa-25-36. Because exploitation requires a valid administrator account, reduce exposure until patching is complete by removing unnecessary admin accounts, enforcing least privilege and strong authentication/MFA, and restricting NAS management interfaces to trusted networks or VPN; these controls trade off administrative convenience but directly address the PR:H prerequisite. No separate workaround is identified in the available data, and no public exploit code is identified at time of analysis.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
QNAP QTS and QuTS hero are NAS operating system families, and CVE-2025-52862 is a CWE-476 NULL pointer dereference that occurs when code follows a null pointer without adequate validation, causing a process or service crash and resulting in denial of service. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L) and the independent CVSS 3.1 assessment (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L) both describe a network-reachable, low-complexity availability impact that requires high privileges; confidentiality and integrity impact are none. The provided CPE data lists QuTS hero builds h5.2.0.2737 build 20240417 through h5.2.2.2952 build 20241116 as affected examples, while EUVD extends the affected range to QTS 5.2.x and QuTS hero h5.2.x prior to 5.2.6.3195 build 20250715.
Know when Qts gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Network-reachable with low complexity but requires an existing administrator account, so PR:H; impact is availability-only (A:L) with no confidentiality or integrity effect and no scope change.
Primary rating from Vendor (qnapsecurity).
CVSS VectorVendor: qnapsecurity
Lifecycle Timeline
3DescriptionCVE.org
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.
We have already fixed the vulnerability in the following versions: QTS 5.2.6.3195 build 20250715 and later QuTS hero h5.2.6.3195 build 20250715 and later
Executive ViewAI
Organizations using A NULL pointer dereference vulnerability should be aware of moderate risk from CVE-2025-52862, a null pointer dereference vulnerability rated CVSS 4.9. Exploitation could compromise the security of affected deployments. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: enable ASLR/DEP, apply network segmentation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
QNAP QTS before 4.2.4 Build 20170313 allows attackers to execute arbitrary commands via unspecified vectors. Rated criti
QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and obtain sensitive information
QNAP has patched a remote code execution vulnerability affecting the QTS Media Library in all versions prior to QTS 4.2.
QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and execute arbitrary commands vi
QNAP QTS before 4.2.4 Build 20170313 allows local users to obtain sensitive Domain Administrator password information by
This command injection vulnerability in QTS allows attackers to run arbitrary commands in the compromised application. R
This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. Rated criti
A prototype pollution vulnerability has been reported to affect several QNAP operating system versions. Rated high sever
A buffer overflow vulnerability in external device function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 2
A buffer overflow vulnerability in password function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117
GitHub PoC
Exploit-DB