Skip to main content

Quts Hero EUVDEUVD-2025-32465

| CVE-2025-48730 MEDIUM
Use of Externally-Controlled Format String (CWE-134)
2025-10-03 security@qnapsecurity.com.tw
Qnap Information Disclosure Quts Hero Qts
6.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

4
Patch available
Apr 16, 2026 - 05:29 EUVD
5.2.6.3195
EUVD ID Assigned
Mar 13, 2026 - 19:29 euvd
EUVD-2025-32465
Analysis Generated
Mar 13, 2026 - 19:29 vuln.today
CVE Published
Oct 03, 2025 - 19:15 nvd
MEDIUM 6.5

DescriptionCVE.org

A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret data or modify memory.

We have already fixed the vulnerability in the following versions: QTS 5.2.6.3195 build 20250715 and later QuTS hero h5.2.6.3195 build 20250715 and later

Analysis

A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret data or modify memory.

We have already fixed the vulnerability in the following versions: QTS 5.2.6.3195 build 20250715 and later QuTS hero h5.2.6.3195 build 20250715 and later

Technical ContextAI

This vulnerability is classified as Use of Externally-Controlled Format String (CWE-134).

RemediationAI

Monitor vendor advisories for patches. Apply mitigations such as network segmentation, access restrictions, and monitoring.

More in Quts Hero

View all
CVE-2023-39296 HIGH POC
7.5 Jan 05

A prototype pollution vulnerability has been reported to affect several QNAP operating system versions. Rated high sever
CVE-2024-32766 CRITICAL
10.0 Apr 26

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. Rated critical
CVE-2025-66277 CRITICAL
9.8 Feb 11

Symlink following vulnerability in multiple QNAP NAS operating system versions allows remote attackers to exploit link r
CVE-2024-21899 CRITICAL POC
9.8 Mar 08

An improper authentication vulnerability has been reported to affect several QNAP operating system versions. Rated criti
CVE-2023-23368 CRITICAL
9.8 Nov 03

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. Rated critical
CVE-2021-28804 CRITICAL
9.8 Jul 01

A command injection vulnerabilities have been reported to affect QTS and QuTS hero. Rated critical severity (CVSS 9.8),

CVE-2021-28802 CRITICAL
9.8 Jul 01

A command injection vulnerabilities have been reported to affect QTS and QuTS hero. Rated critical severity (CVSS 9.8),

CVE-2025-66276 CRITICAL
9.2 Jun 10

High-severity information disclosure flaw in QNAP QTS NAS operating system versions 5.2.0 through 5.2.7.3256 build 20250
CVE-2025-22481 HIGH
8.8 Jun 06

Command injection vulnerability affecting QNAP NAS operating systems (QTS and QuTS hero) that allows authenticated remot
CVE-2024-21898 HIGH
8.8 Sep 06

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. Rated high sev
CVE-2024-27130 HIGH
8.8 May 21

A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system ver
CVE-2024-27129 HIGH
8.8 May 21

A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system ver

Same weakness CWE-134 – Use of Externally-Controlled Format String

View all
CVE-2012-3569 CRITICAL POC
9.3
CVE-2012-2288 CRITICAL POC
9.3
CVE-2014-1683 MEDIUM POC
6.8
CVE-2012-10055 CRITICAL POC
9.3
CVE-2012-1851 CRITICAL
10.0
CVE-2012-0809 HIGH POC
7.2
CVE-2015-8617 CRITICAL POC
9.8
CVE-2020-13160 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

EUVD-2025-32465 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy