EUVD-2025-32469Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain QNAP admin account
-
ExploitAuthenticate to management interface
-
ExecutionSend crafted request triggering NULL deref
-
ImpactService/device denial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already possess a QNAP administrator account (CVSS PR:H) and network access to the device's management interface (AV:N). The vulnerability affects QTS 5.2.x and QuTS hero h5.2.x builds prior to the 20250715 fix; no special non-default feature toggle is named in the description beyond holding admin privileges. The administrator-credential requirement is the primary limiting factor and sharply reduces realistic risk, since the outcome is only a denial of service (VA:L) against an attacker who already controls the appliance's admin plane. |
| Impact | This is a genuinely low-priority, high-barrier vulnerability despite its MEDIUM rating. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N, score 5.1) is internally consistent with the description: PR:H confirms the attacker must already hold an administrator account, and the only impact is VA:L (limited availability loss via DoS) with no confidentiality or integrity impact (VC:N/VI:N). All exploitation signals point the same direction and do not conflict: EPSS is 0.14% (34th percentile), the vulnerability is NOT on CISA KEV, and no public exploit code is referenced. CWE-476 (NULL pointer dereference) aligns with the stated DoS-only outcome. The decisive limiting factor is the administrator-authentication prerequisite - an attacker who already has admin on a QNAP NAS has far more impactful options than crashing a service, which is why real-world exploitation interest is minimal. No SSVC decision data was provided in the input, so an SSVC-based assessment cannot be made. Treat this as routine patch-management, not an emergency. |
| Exploit ScenarioDerived | An attacker who has already obtained QNAP administrator credentials (via phishing, credential reuse, or a prior compromise) sends a crafted request to a management interface that triggers a NULL pointer dereference, crashing the affected service or the device and causing a denial of service. No public exploit code is identified at time of analysis, and the low availability impact (VA:L) suggests a service interruption rather than full, persistent device takedown. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 18, 2026
Authenticated denial of service in QNAP QTS 5.2.x and QuTS hero h5.2.x: a remote attacker who already holds an administrator account on the NAS can trigger a NULL pointer dereference that disrupts service on the appliance. Exploitation requires the highest privilege level (CVSS PR:H) over the network against the management plane, and the resulting impact is limited to availability; there is no confidentiality or integrity loss. QNAP has released fixed builds (QTS 5.2.6.3195 build 20250715 and QuTS hero h5.2.6.3195 build 20250715), EPSS is low at roughly 0.14% (34th percentile), and no public exploit code or confirmed active exploitation was identified at time of analysis.
Earlier versions of this analysis (1)
RemediationAI
Vendor-released patch: upgrade to QTS 5.2.6.3195 build 20250715 or later, or QuTS hero h5.2.6.3195 build 20250715 or later, following the instructions in QNAP advisory QSA-25-36 (https://www.qnap.com/en/security-advisory/qsa-25-36). Because the prerequisite is a valid administrator account, the highest-value compensating control is credential hygiene: eliminate shared admin accounts, enable MFA where the firmware supports it, and audit accounts with administrative rights, since any such account can already crash the device with or without this CVE. Additionally, remove direct internet exposure of the QTS/QuTS hero management interface (Web Administration on ports 8080/443) by placing it behind a VPN or restricting source IPs at the firewall - this blocks remote (AV:N) reachability, at the cost of requiring VPN access for legitimate administrators. If patching must be deferred, monitor for repeated service restarts or unexpected management-plane crashes as an indicator of attempted exploitation, and consider restricting admin logins to the local subnet, accepting the operational inconvenience of no off-site administration.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a NULL pointer dereference (CWE-476) in the QNAP QTS and QuTS hero operating systems - the embedded Linux-based firmware that runs on QNAP NAS appliances and exposes web-based administrative services. In such a defect, a code path fails to validate a pointer before dereferencing it, causing the process (or potentially the servicing daemon) to crash rather than execute attacker-controlled logic; because the outcome is a crash rather than memory corruption, the practical impact is availability, not code execution. The CPE data enumerates affected QTS 5.2.0.x and 5.2.1.x/5.2.2.x/5.2.3.x firmware builds from 5.2.0.2737 (build 20240417) through 5.2.3.3006 (build 20250108), confirming this is a defect in the 5.2 branch of the firmware rather than a web application plugin. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N with only VA:L) and our independent CVSS 3.1 assessment (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L) agree that the attacker must already possess administrative credentials and that only limited availability impact is achievable, which sharply constrains real-world risk.
Know when Qts gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Remote reachable (AV:N) but requires an administrator account (PR:H); only a denial-of-service outcome, so A:L with no confidentiality or integrity impact.
Primary rating from Vendor (qnapsecurity).
CVSS VectorVendor: qnapsecurity
Lifecycle Timeline
3DescriptionCVE.org
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.
We have already fixed the vulnerability in the following versions: QTS 5.2.6.3195 build 20250715 and later QuTS hero h5.2.6.3195 build 20250715 and later
Executive ViewAI
Organizations using A NULL pointer dereference vulnerability should be aware of moderate risk from CVE-2025-52424, a null pointer dereference vulnerability rated CVSS 4.9. Exploitation could compromise the security of affected deployments. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: enable ASLR/DEP, apply network segmentation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
QNAP QTS before 4.2.4 Build 20170313 allows attackers to execute arbitrary commands via unspecified vectors. Rated criti
QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and obtain sensitive information
QNAP has patched a remote code execution vulnerability affecting the QTS Media Library in all versions prior to QTS 4.2.
QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and execute arbitrary commands vi
QNAP QTS before 4.2.4 Build 20170313 allows local users to obtain sensitive Domain Administrator password information by
This command injection vulnerability in QTS allows attackers to run arbitrary commands in the compromised application. R
This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. Rated criti
A prototype pollution vulnerability has been reported to affect several QNAP operating system versions. Rated high sever
A buffer overflow vulnerability in external device function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 2
A buffer overflow vulnerability in password function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117
GitHub PoC
Exploit-DB