QNAP QTS EUVD-2026-35975

Exploitation requires the attacker to hold a valid administrator account on the target QNAP device; this is confirmed by the CVSS 4.0 vector PR:H (High Privileges Required). An unauthenticated remote attacker cannot directly trigger this vulnerability. The limiting factor is this elevated authentication prerequisite - an attacker must first compromise admin credentials through a separate vector (credential reuse, brute force, phishing) before the NULL pointer dereference becomes reachable. No special non-default configuration or specific feature enablement is stated in available data beyond the admin account requirement. Affected devices running QTS or QuTS hero within the vulnerable version ranges are at risk once the admin access prerequisite is met.

The CVSS 4.0 base score of 5.1 (Medium) accurately reflects the constrained threat model: network reachable (AV:N) with low attack complexity (AC:L), but gated entirely behind high-privilege authentication (PR:H), which substantially limits the realistic attacker population to those who have already compromised an admin account. The impact is further bounded - confidentiality impact is Low (VC:L) and availability impact is Low (VA:L), with no integrity or scope change. No EPSS score was provided in the available data, precluding probabilistic exploitation likelihood comparison. This vulnerability is absent from the CISA KEV catalog and no public exploit code has been identified. The primary real-world risk vector is QNAP devices exposed to the internet with weak, reused, or previously breached administrator credentials - a known endemic problem for QNAP deployments. Organizations with properly hardened admin access and network-segmented NAS devices face low realistic risk.

An attacker who has obtained administrator credentials to a QNAP NAS - through credential stuffing, phishing, or reuse of previously leaked passwords - authenticates remotely to the management interface and sends a specially crafted request that triggers a NULL pointer dereference within the OS, causing a targeted system crash or prolonged service interruption. No public exploit code exists at time of analysis, so exploitation currently requires manual knowledge of the vulnerable code path.