QNAP QTS EUVD-2025-32446

Exploitation requires the attacker to already possess a QNAP administrator account on the device (CVSS PR:H; vendor states 'if a remote attacker gains an administrator account'). The flaw affects QTS 5.2.x and QuTS hero h5.2.x builds prior to the fixed releases (build 20250715/20250716). The administrator-privilege requirement is the primary limiting factor - this is not remotely exploitable by unauthenticated users; no user interaction is needed (UI:N) and attack complexity is low (AC:L) once admin access is held. Impact is limited to denial of service (availability only); there is no data exposure or code execution.

This is a medium-severity issue (CVSS 4.0 base 5.1) that should be treated as low-to-moderate real-world priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N) is network-reachable with low complexity, but critically requires high privileges (PR:H) - the description explicitly confirms the attacker must already hold an administrator account, which sharply limits who can exploit it. Impact is confined to availability (VA:L) via a NULL pointer dereference (CWE-476); there is no confidentiality or integrity impact (VC:N/VI:N). The EPSS score of 0.14% (34th percentile) is low and consistent with the low severity and the privilege barrier, indicating little likelihood of mass exploitation. There is no CISA KEV listing and no public exploit identified at time of analysis, so no active-exploitation or POC signals elevate the risk. No SSVC decision data was provided. The signals are internally consistent - none conflict. The main caveat: an admin-level DoS is a limited threat because an administrator can typically disrupt the device through legitimate means anyway, so the practical added risk comes mainly from a lower-privileged admin role or a compromised/abused admin session rather than from an external unauthenticated attacker.

An attacker who has already obtained QNAP administrator credentials (e.g., via phishing, credential reuse, or a compromised admin session) sends a crafted request over the network that triggers a NULL pointer dereference, crashing the affected service or the NAS and causing a denial of service. No public exploit code is known, and the low attack complexity means the crash is reliable once admin access is held, but the requirement for an administrator account is the dominant barrier.