EUVD-2025-32464Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain QNAP administrator credentials
-
ExploitAuthenticate to device management interface
-
ExecutionInject OS command via vulnerable admin function
-
ImpactExecute arbitrary commands on NAS OS
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the remote attacker to first possess a valid QNAP administrator account on a device running an affected build of QTS 5.2.x or QuTS hero h5.2.x (below QTS 5.2.6.3195 build 20250715 / h5.2.6.3195 build 20250715). The administrator privilege requirement (PR:H) is the primary limiting factor: this is a post-authentication, privileged-user flaw, so it cannot be triggered by an unauthenticated or low-privileged remote attacker. No user interaction is required (UI:N) and it is exploitable over the network once admin access is held. The specific vulnerable feature or management endpoint is not named in the vendor description. |
| Impact | This is a medium-severity, lower-priority issue rather than an urgent threat. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L) scores 5.1 and the single most important mitigating signal is PR:H - exploitation requires the attacker to ALREADY hold an administrator account on the QNAP device. The low Vulnerable System impacts (VC:L/VI:L/VA:L) reflect that an admin already possesses broad control, so command injection yields only marginal additional capability. EPSS is low at 0.13% (32nd percentile), there is no CISA KEV listing, and no public exploit code is identified - all three exploitation signals are consistent and point to no imminent mass exploitation. The signals do not conflict: a privilege-gated post-authentication flaw with low EPSS and no KEV is correctly treated as a defense-in-depth / patch-in-cycle item, not an emergency. Note the network attack vector (AV:N) could appear alarming in isolation, but it is gated behind administrator authentication, which realistically limits the attacker population. |
| Exploit ScenarioDerived | An attacker who has already compromised or legitimately possesses a QNAP administrator account (e.g., via phished/reused credentials or a prior foothold) sends crafted input to a vulnerable management function, which passes attacker-controlled data to a shell command. This lets the attacker break out of the intended admin functionality to run arbitrary OS commands on the NAS. No public exploit code is identified at time of analysis, so any attack would require custom development. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 18, 2026
Command injection in QNAP QTS 5.2.x and QuTS hero h5.2.x lets a remote attacker who already holds a valid administrator account run arbitrary commands on the NAS, yielding limited confidentiality, integrity, and availability impact. The administrator privilege requirement (PR:H) is the main limiting factor: this is a post-authentication, privileged-user flaw, not something an unauthenticated or low-privileged attacker can trigger. QNAP has released fixed builds (QTS 5.2.6.3195 build 20250715 and QuTS hero h5.2.6.3195 build 20250715); EPSS is low (0.13%, 32nd percentile) and there is no public exploit or KEV listing, making this a medium-severity, lower-priority issue rather than an urgent threat.
Earlier versions of this analysis (1)
RemediationAI
Vendor-released patch: upgrade QTS to 5.2.6.3195 build 20250715 or later, and QuTS hero to h5.2.6.3195 build 20250715 or later, per QNAP advisory QSA-25-36 (https://www.qnap.com/en/security-advisory/qsa-25-36). Because exploitation requires an existing administrator account, the highest-value compensating controls are reducing admin exposure and containing credential compromise: restrict the QTS/QuTS hero management interface to trusted management networks or VPN rather than the public internet (trade-off: off-site administration requires VPN access), remove or tightly scope additional administrator accounts and enforce strong, unique credentials with MFA where supported (trade-off: administrative overhead and potential lockout risk if credentials are mismanaged), and rotate admin credentials and audit administrative logs if compromise is suspected. Since there is no public exploit or KEV confirmation, prioritise patching at the next maintenance window rather than as an emergency, and verify the installed build number after upgrading.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic OS command injection (CWE-78) in QNAP's QTS and QuTS hero operating systems, meaning user-supplied input reaching some management or feature interface is passed to a system shell without adequate neutralization, allowing an attacker to append or inject shell metacharacters and execute arbitrary commands with the privileges of the underlying service. Because the injection point sits behind administrative functionality, exploitation presupposes an already-compromised or legitimately held admin account, consistent with the assessed CVSS:3.1 vector AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L. The affected CPEs enumerate QTS 5.2.x builds from 5.2.0.2737 (build 20240417) through 5.2.3.3006 (build 20250108), and EUVD extends this to QuTS hero h5.2.x below h5.2.6.3195 build 20250715. The vendor description does not name the specific vulnerable feature or management endpoint, so defenders should treat QTS/QuTS hero administrative interfaces as the likely attack surface.
Know when Qts gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Network-reachable management function (AV:N/AC:L) but gated behind an administrator account (PR:H); impacts kept Low because an admin already holds broad control, yielding only marginal additional access.
Primary rating from Vendor (qnapsecurity).
CVSS VectorVendor: qnapsecurity
Lifecycle Timeline
5DescriptionCVE.org
A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands.
We have already fixed the vulnerability in the following versions: QTS 5.2.6.3195 build 20250715 and later QuTS hero h5.2.6.3195 build 20250715 and later
Executive ViewAI
CVE-2025-47212 is a command injection vulnerability in QNAP NAS operating systems that allows authenticated administrators to execute arbitrary commands, potentially enabling lateral movement and system compromise within network-attached storage infrastructure. Organizations running affected QTS or QuTS hero versions must prioritize patching to prevent insider threats and post-compromise persistence attacks from compromised administrative credentials.
Apply vendor patch. Until patching is complete: restrict administrator account access to authorized personnel only, disable unnecessary remote access protocols (SSH, Telnet) where not required, implement network segmentation to isolate NAS devices, and enable detailed audit logging of administrative actions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
QNAP QTS before 4.2.4 Build 20170313 allows attackers to execute arbitrary commands via unspecified vectors. Rated criti
QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and obtain sensitive information
QNAP has patched a remote code execution vulnerability affecting the QTS Media Library in all versions prior to QTS 4.2.
QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and execute arbitrary commands vi
QNAP QTS before 4.2.4 Build 20170313 allows local users to obtain sensitive Domain Administrator password information by
This command injection vulnerability in QTS allows attackers to run arbitrary commands in the compromised application. R
This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. Rated criti
A prototype pollution vulnerability has been reported to affect several QNAP operating system versions. Rated high sever
A buffer overflow vulnerability in external device function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 2
A buffer overflow vulnerability in password function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117
GitHub PoC
Exploit-DB