EUVD-2025-32466Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain QNAP administrator credentials
-
ExploitSend crafted request triggering NULL deref
-
ImpactCrash service causing denial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already possess a valid administrator account on the QNAP device (CVSS PR:H), reachable over the network to the QTS/QuTS hero management service. The description explicitly states 'if a remote attacker gains an administrator account, they can then exploit the vulnerability,' making prior administrative compromise the hard prerequisite and the primary limiting factor. Impact is limited to a denial-of-service crash (no data exposure or modification), and only QTS and QuTS hero 5.2.x branches below build 5.2.6.3195 (20250715) are affected; patched builds eliminate the condition. |
| Impact | This is a genuine but low-priority issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N, VA:L only) and score of 5.1 (medium) describe a network-reachable but high-privilege flaw: the attacker must already hold a QNAP administrator account, and the sole impact is a partial availability loss (denial of service) with no confidentiality or integrity effect, consistent with the CWE-476 NULL pointer dereference. All exploitation signals agree that real-world risk is modest: EPSS is 0.14% (34th percentile), this CVE is NOT on the CISA KEV list, and no public exploit code is referenced. SSVC-style reasoning aligns - exploitation is not observed, technical impact is partial (DoS only), and automatability is low because a valid admin credential is a prerequisite. The signals are internally consistent and do not conflict. The key caveat is the trust model: an attacker with administrator access to a NAS can already cause disruption through legitimate functions, so this vulnerability adds marginal attacker capability (an un-graceful crash) rather than a new privilege boundary break. Prioritize routine patching rather than emergency response. |
| Exploit ScenarioDerived | An attacker who has already obtained QNAP administrator credentials (via phishing, credential reuse, or a separate compromise) sends a crafted request to the QTS/QuTS hero management interface that triggers a NULL pointer dereference, crashing the affected service or device. No public exploit code has been identified, and the requirement for a valid administrator account substantially limits realistic abuse. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 18, 2026
Denial of service in QNAP QTS and QuTS hero 5.2.x requires an attacker to already hold a valid administrator account; once authenticated, a crafted request to the network-reachable management service can trigger a NULL pointer dereference and disrupt the service. QNAP has released fixed builds, no public exploit code has been identified at time of analysis, and EPSS is low at 0.14%, so this is a genuine but low-priority issue constrained by the high-privilege prerequisite.
Earlier versions of this analysis (1)
RemediationAI
Upgrade QTS to 5.2.6.3195 build 20250715 or later and QuTS hero to h5.2.6.3195 build 20250715 or later; this is the vendor-released patch and the definitive fix, documented in QNAP QSA-25-36 at https://www.qnap.com/en/security-advisory/qsa-25-36. If immediate upgrade is not possible, reduce exposure of the QTS/QuTS hero management interface by restricting it to trusted administrative VLANs or VPN access, disabling WAN/remote administration where it is not required, and limiting the number of administrator accounts; these measures lower opportunity but do not remove the bug and may complicate legitimate remote administration. Because exploitation requires a valid administrator account, enforce strong unique administrator credentials, use MFA where supported, apply least-privilege administration, and audit for compromised or misused admin sessions. No public exploit was identified at time of analysis.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is a CWE-476 NULL pointer dereference in QNAP QTS and QuTS hero management functionality. The supplied CPE entries enumerate QTS 5.2.0.2737 build 20240417 through 5.2.3.3006 build 20250108, while EUVD identifies the affected ranges as QTS 5.2.x before 5.2.6.3195 build 20250715 and QuTS hero h5.2.x before h5.2.6.3195 build 20250715. The CVSS 4.0 vector has AV:N/AC:L/PR:H/VA:L and no confidentiality or integrity impact, matching the independent assessment that an attacker must already possess a valid administrator account and can only cause availability loss. Exploitation therefore depends on prior administrative compromise or credential misuse rather than pre-authentication access to the management service.
Know when Qts gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Network-reachable management interface (AV:N) but requires an existing administrator account (PR:H); only a partial DoS, so A:L with C:N/I:N and no scope change.
Primary rating from Vendor (qnapsecurity).
CVSS VectorVendor: qnapsecurity
Lifecycle Timeline
3DescriptionCVE.org
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.
We have already fixed the vulnerability in the following versions: QTS 5.2.6.3195 build 20250715 and later QuTS hero h5.2.6.3195 build 20250715 and later
Executive ViewAI
Organizations using A NULL pointer dereference vulnerability should be aware of moderate risk from CVE-2025-48729, a null pointer dereference vulnerability rated CVSS 4.9. Exploitation could compromise the security of affected deployments. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: enable ASLR/DEP, apply network segmentation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
QNAP QTS before 4.2.4 Build 20170313 allows attackers to execute arbitrary commands via unspecified vectors. Rated criti
QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and obtain sensitive information
QNAP has patched a remote code execution vulnerability affecting the QTS Media Library in all versions prior to QTS 4.2.
QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and execute arbitrary commands vi
QNAP QTS before 4.2.4 Build 20170313 allows local users to obtain sensitive Domain Administrator password information by
This command injection vulnerability in QTS allows attackers to run arbitrary commands in the compromised application. R
This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. Rated criti
A prototype pollution vulnerability has been reported to affect several QNAP operating system versions. Rated high sever
A buffer overflow vulnerability in external device function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 2
A buffer overflow vulnerability in password function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117
GitHub PoC
Exploit-DB