Qnap
Monthly
A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. [CVSS 6.5 MEDIUM]
A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. [CVSS 6.5 MEDIUM]
A buffer overflow vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. [CVSS 8.1 HIGH]
A buffer overflow vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. [CVSS 8.1 HIGH]
A buffer overflow vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. [CVSS 8.1 HIGH]
A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. [CVSS 8.1 HIGH]
A buffer overflow vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. [CVSS 8.1 HIGH]
A buffer overflow vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. [CVSS 8.1 HIGH]
A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. [CVSS 6.5 MEDIUM]
A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. [CVSS 6.5 MEDIUM]
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. [CVSS 4.9 MEDIUM]
An out-of-bounds write vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to modify or corrupt memory. [CVSS 8.8 HIGH]
A use of externally-controlled format string vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to obtain secret data or modify memory. [CVSS 8.1 HIGH]
A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. [CVSS 6.5 MEDIUM]
A command injection vulnerability has been reported to affect Media Streaming add-on. If an attacker gains local network access who have also gained a user account, they can then exploit the vulnerability to execute arbitrary commands. [CVSS 7.8 HIGH]
An out-of-bounds read vulnerability has been reported to affect Media Streaming add-on. If an attacker gains local network access, they can then exploit the vulnerability to obtain secret data. [CVSS 5.5 MEDIUM]
An exposure of sensitive system information to an unauthorized control sphere vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to read application data. [CVSS 7.5 HIGH]
A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to modify memory or crash processes. [CVSS 6.5 MEDIUM]
An external control of file name or path vulnerability has been reported to affect HBS 3 Hybrid Backup Sync. If an attacker gains local network access, they can then exploit the vulnerability to read or modify files or directories. [CVSS 7.8 HIGH]
Information disclosure in QNAP Hybrid Backup Sync (HBS 3) prior to 26.2.0.938 allows an attacker with local network access or physical proximity to a QNAP NAS appliance to read application data through generated error messages that contain sensitive information. Exploitation requires no authentication once proximity is obtained and no user interaction, but it is not reachable by remote internet-based attackers; impact is confined to confidentiality, not code execution or data modification. No public exploit identified at time of analysis, and EPSS is low at 0.02% (4th percentile).
SQL injection in QNAP Hyper Data Protector allows unauthenticated remote attackers to execute unauthorized code or commands on affected QNAP NAS devices. The flaw affects versions prior to 2.2.4.1, which is the vendor-released patch. No public exploit code has been identified at time of analysis, and the EPSS score is low at 0.12%, though the vulnerability carries a high severity rating due to the potential for complete compromise of confidentiality, integrity, and availability.
Unauthenticated SQL injection in QNAP MARS (Multi-Application Recovery Service) versions prior to 1.2.1.1686 allows remote attackers to execute unauthorized code or commands, as reported by QNAP. The vulnerability is network-reachable with no authentication or user interaction required (CVSS 4.0 base score 8.1, High), and the vendor has released a patch in version 1.2.1.1686. EPSS score is 0.16% (36th percentile), indicating low likelihood of exploitation; no public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated path traversal in QNAP Qfiling 3.13.0 allows remote attackers who can reach the application's web interface on a QNAP NAS to read files and system data outside the intended Qfiling directories, including content accessible to the Qfiling service account. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms the flaw is exploitable remotely with no authentication, privileges, or user interaction, and the vendor reports it fixed in Qfiling 3.13.1 and later. No public exploit code has been identified at time of analysis and the EPSS score is negligible (0.07%, ~22nd percentile), so real-world priority is moderate rather than emergency; exposure is limited to NAS devices that actually have the optional Qfiling application installed and network-reachable.
A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. [CVSS 4.9 MEDIUM]
A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. [CVSS 4.9 MEDIUM]
A buffer overflow vulnerability has been reported to affect License Center. If a remote attacker gains an administrator account, they can then exploit the vulnerability to modify memory or crash processes. [CVSS 6.5 MEDIUM]
An out-of-bounds read vulnerability has been reported to affect License Center. If a remote attacker gains a user account, they can then exploit the vulnerability to obtain secret data. [CVSS 6.5 MEDIUM]
A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to modify memory or crash processes. [CVSS 6.5 MEDIUM]
QNAP Malware Remover before 6.6.8.20251023 has a code generation vulnerability that allows remote attackers to bypass the protection mechanism. An ironic vulnerability in a security tool that is supposed to protect QNAP NAS devices.
A cross-site scripting (XSS) vulnerability has been reported to affect QuMagie. The remote attackers can then exploit the vulnerability to bypass security mechanisms or read application data. [CVSS 6.1 MEDIUM]
An allocation of resources without limits or throttling vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource. We have already fixed the vulnerability in the following versions: QTS 5.2.7.3256 build 20250913 and later QuTS hero h5.2.7.3256 build 20250913 and later QuTS hero h5.3.1...
An out-of-bounds read vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret data. [CVSS 4.9 MEDIUM]
An out-of-bounds read vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret data. [CVSS 4.9 MEDIUM]
An out-of-bounds read vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret data. [CVSS 4.9 MEDIUM]
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. [CVSS 4.9 MEDIUM]
A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to modify memory or crash processes. [CVSS 6.5 MEDIUM]
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. [CVSS 6.5 MEDIUM]
Quts Hero versions up to h5.2.0.2737 is affected by use of externally-controlled format string (CVSS 6.5).
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. [CVSS 4.9 MEDIUM]
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. [CVSS 4.9 MEDIUM]
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. [CVSS 4.9 MEDIUM]
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. [CVSS 4.9 MEDIUM]
A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. [CVSS 8.1 HIGH]
A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. [CVSS 8.1 HIGH]
A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. [CVSS 8.1 HIGH]
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. [CVSS 4.9 MEDIUM]
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. [CVSS 4.9 MEDIUM]
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. [CVSS 4.9 MEDIUM]
Quts Hero versions up to h5.2.0.2737 is affected by allocation of resources without limits or throttling (CVSS 6.5).
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. [CVSS 6.5 MEDIUM]
SQL injection in QNAP QTS and QuTS hero NAS operating systems lets remote, unauthenticated attackers run unauthorized code or commands, but only when a specific precondition on the target holds and a legitimate user is drawn into some passive interaction, so it is not reliably exploitable against an arbitrary default deployment. Affected builds span QTS 5.2.0.x through 5.2.3.3006 and the corresponding QuTS hero releases prior to the October 2025 fixes; the exact injectable feature or endpoint is not disclosed in the available data. No public exploit code was identified at time of analysis and CISA KEV does not list this CVE, while EPSS places it at roughly 0.97% (61st percentile) - a moderate-priority issue rather than a critical emergency, with the strongest real-world risk falling on internet-exposed NAS management interfaces.
Denial-of-service through a NULL pointer dereference in QNAP QTS 5.2.x and QuTS hero allows remote, unauthenticated attackers to crash affected NAS services by sending crafted requests. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms network reachability and no authentication or user interaction are required; the independent assessment scores this as availability-only impact (CVSS 3.1 A:H), so exploitation results in service disruption rather than code execution or data compromise. No public exploit code has been identified at time of analysis, and EPSS/KEV data were not provided; the practical risk is driven almost entirely by whether the NAS management or service interfaces are exposed to untrusted networks. QNAP has released fixed builds, so unpatched, internet-facing appliances are the primary exposure.
Unauthenticated remote argument injection (CWE-88) in QNAP's QTS and QuTS hero NAS operating systems lets attackers alter command execution logic on reachable devices, yielding a high-integrity-loss but no-confidentiality or availability impact. Affected builds are QTS 5.2.x prior to 5.2.7.3297 build 20251024 and QuTS hero prior to h5.2.7.3297 / h5.3.1.3292 build 20251024; per the CVSS 4.0 vector, no privileges, user interaction, or special conditions are required, making internet-exposed NAS the highest-risk deployments. No public exploit code has been identified at time of analysis and the flaw is not in CISA KEV; EPSS is 0.82% (56th percentile), indicating low but non-trivial predicted exploitation activity.
Authentication bypass by spoofing in QNAP QTS and QuTS hero lets unauthenticated remote attackers reach resources that should require a valid login, yielding high confidentiality, integrity, and availability impact per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Affected systems are QTS builds from 5.2.0.x through 5.2.3.x and the corresponding QuTS hero releases prior to the 20251024 fix builds. No public exploit code has been identified at time of analysis and the CVE is not on the CISA KEV catalog, but the unauthenticated network vector combined with the frequent internet exposure of NAS management interfaces makes this a high-priority patching item; QNAP has released fixed firmware.
Photo Station 5.4.1 & 5.2.7 include the security fix for the vulnerability related to the XMR mining programs identified by internal research. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A cross-site request forgery (CSRF) vulnerability has been reported to affect QuLog Center. Rated low severity (CVSS 1.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A cross-site scripting (XSS) vulnerability has been reported to affect Download Station. Rated low severity (CVSS 2.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A relative path traversal vulnerability has been reported to affect QuMagie. Rated high severity (CVSS 7.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A relative path traversal vulnerability has been reported to affect Download Station. Rated low severity (CVSS 2.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A path traversal vulnerability has been reported to affect Qsync Central. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A cross-site scripting (XSS) vulnerability has been reported to affect File Station 5. Rated low severity (CVSS 2.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A cross-site scripting (XSS) vulnerability has been reported to affect QuLog Center. Rated low severity (CVSS 2.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A NULL pointer dereference vulnerability has been reported to affect File Station 5. Rated low severity (CVSS 0.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. Rated low severity (CVSS 1.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A NULL pointer dereference vulnerability has been reported to affect File Station 5. Rated low severity (CVSS 1.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A NULL pointer dereference vulnerability has been reported to affect File Station 5. Rated low severity (CVSS 1.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An SQL injection vulnerability has been reported to affect QuMagie. Rated critical severity (CVSS 9.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A NULL pointer dereference vulnerability has been reported to affect several product versions. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
NetBak Replicator 4.5.x on Windows allows an authenticated local user to execute arbitrary code via an unquoted search path, resulting in local privilege escalation. The flaw (CWE-428) affects versions before 4.5.15.0807 and requires an existing low-privileged account; execution occurs when the affected service or process starts or restarts, not instantaneously. No public exploit identified at time of analysis, and EPSS is low at 0.02%, though the vendor rates the issue High with a CVSS 4.0 score of 8.5.
Improper authentication in QNAP Authenticator 1.3.x before 1.3.1.1227 lets an unauthenticated attacker who gains physical access to the device running the mobile/companion app subvert authentication and compromise the security of the authenticator installation. The flaw is not remotely exploitable, requires passive user interaction, and is assessed as low-to-moderate real-world risk despite a 6.9 Medium CVSS 4.0 score; EPSS is 0.06% (20th percentile), and no public exploit or CISA KEV entry is identified. QNAP has released a fixed build, 1.3.1.1227 and later.
A use of externally-controlled format string (CWE-134) in QNAP QTS and QuTS hero 5.2.x lets an attacker who already holds a QNAP administrator account pass crafted format specifiers into a logging or string-handling routine, potentially disclosing secret data or corrupting process memory on the NAS. Exploitation is gated by the admin-credential prerequisite (PR:H) and the assessed impact is limited to low confidentiality and integrity loss with no availability effect, so realistic exposure comes from insiders, stolen admin credentials, or post-compromise abuse rather than opportunistic remote attacks. EPSS is 0.05% (16th percentile), no public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV; QNAP has released fixed builds in QTS 5.2.6.3195 build 20250715 and QuTS hero h5.2.6.3195 build 20250715.
QNAP QTS and QuTS hero contain a format-string vulnerability that an attacker holding administrator credentials can exploit remotely to read sensitive data or modify memory. Affected are QTS 5.2.x before 5.2.6.3195 build 20250715 and QuTS hero h5.2.x before h5.2.6.3195 build 20250715; patched builds are not vulnerable. Risk is moderate because the administrator-account prerequisite limits exploitation, EPSS is 0.05%, and no public exploit or CISA KEV entry was identified at time of analysis.
Privileged denial-of-service in QNAP QTS and QuTS hero 5.2.x allows a remote attacker who already holds a working administrator account to trigger a NULL pointer dereference and degrade or interrupt the affected NAS service. Only devices running QTS or QuTS hero builds prior to 5.2.6.3195 build 20250715 are affected, and the high privilege prerequisite (PR:H) sharply limits the realistic attacker population to insiders or parties who have already stolen admin credentials. EPSS is low at 0.14% (34th percentile), and no public exploit code has been identified at time of analysis; QNAP has released fixed builds under advisory QSA-25-36.
Denial of service in QNAP QTS and QuTS hero 5.2.x allows a remote attacker who already holds a valid administrator account to crash affected NAS systems by triggering a NULL pointer dereference. The issue is network-reachable with low attack complexity but is gated by the high-privilege requirement, so only authenticated administrative users can exploit it, and impact is limited to availability. QNAP has released fixed builds and no public exploit or active exploitation is identified at time of analysis; EPSS is 0.14% (34th percentile), consistent with low observed risk.
A NULL pointer dereference in QNAP QTS and QuTS hero 5.2.x allows an attacker who already holds a valid administrator account on the NAS to trigger a denial-of-service condition over the network, causing the affected service or system to crash. Because the CVSS vector requires high privileges (PR:H) and impact is limited to availability (A:L), the practical risk is confined to post-compromise or insider scenarios rather than opportunistic remote attack; EPSS is just 0.14% (34th percentile) and no public exploit or CISA KEV entry is associated with the flaw. QNAP has released fixed builds (QTS 5.2.6.3195 and QuTS hero h5.2.6.3195, build 20250715) that eliminate the vulnerability.
Privileged denial-of-service in QNAP QTS and QuTS hero lets an attacker who already holds an administrator account crash affected NAS services by triggering a NULL pointer dereference. QTS 5.2.x and QuTS hero h5.2.x before 5.2.6.3195 build 20250715 are affected; impact is availability-only and requires high privileges, and no public exploit has been identified at time of analysis (EPSS 0.14%).
Authenticated administrator-level denial of service in QNAP QTS and QuTS hero allows a remote attacker with a valid administrator account to trigger a NULL pointer dereference and crash or degrade the affected NAS service. Affected builds are QTS 5.2.x before 5.2.6.3195 build 20250715 and QuTS hero h5.2.x before h5.2.6.3195 build 20250715, and the vendor has released fixed builds. Despite a 5.1 MEDIUM CVSS 4.0 score, the administrator-privilege prerequisite and availability-only impact make this a low-priority issue; no public exploit identified at time of analysis, no CISA KEV entry, and EPSS is 0.14% (34th percentile).
A NULL pointer dereference in QNAP QTS and QuTS hero 5.2.x (prior to builds 5.2.6.3195 / h5.2.6.3195 of 20250715) allows a remote attacker who already holds a QNAP administrator account to crash or destabilize the device, producing a denial-of-service condition limited to availability impact. The PR:H prerequisite is the dominant limiting factor: only insiders, credential thieves, or attackers chaining a separate authentication bypass can reach the flaw, and no public exploit code or active exploitation (CISA KEV) is associated with it. EPSS is 0.14% (34th percentile), and the vendor has released fixed builds, making this a low-priority, patching-hygiene issue rather than an urgent exposure.
A denial-of-service condition exists in the QNAP QTS and QuTS hero NAS operating systems, where a NULL pointer dereference can be triggered by an attacker who already holds a valid administrator account on the device, crashing the affected service. Only builds prior to QTS 5.2.6.3195 build 20250715 and QuTS hero h5.2.6.3195 build 20250715 are vulnerable, and the mandatory administrative privilege (PR:H) is the dominant limiting factor, confining realistic exploitation to insiders or attackers who have already compromised admin credentials. No public exploit code has been identified at time of analysis and EPSS is low at 0.14% (34th percentile), consistent with an availability-only impact and a high-privilege prerequisite.
Denial of service in QNAP QTS and QuTS hero 5.2.x allows an attacker who already holds a QNAP administrator account to crash the device or service by triggering a NULL pointer dereference. Affected deployments are QTS before 5.2.6.3195 build 20250715 and QuTS hero before h5.2.6.3195 build 20250715; the vector is network-reachable, but PR:H is the central limiting prerequisite. EPSS is 0.14% (34th percentile), no public exploit identified at time of analysis, and QNAP has released fixed builds; overall risk is low-priority and confined to environments where an administrator account is already malicious or compromised.
A post-authentication NULL pointer dereference in QNAP QTS and QuTS hero 5.2.x lets a remote attacker who already holds a valid administrator account crash the device management plane, causing a denial-of-service condition with no confidentiality or integrity impact. The administrative privilege prerequisite (CVSS PR:H) is the hard limiting factor: without admin credentials the flaw cannot be reached, so realistic exploitation is confined to attackers who have already compromised or been granted admin access. No public exploit code and no CISA KEV listing were identified at time of analysis, and EPSS is low at 0.14% (34th percentile); this is a medium-severity, low-priority issue in practice, and vendor fixes are already available.
Denial of service in QNAP QTS and QuTS hero 5.2.x stems from a NULL pointer dereference that an attacker can trigger only after obtaining a valid administrator account, producing a limited availability impact rather than code execution or data compromise. The administrator-credential prerequisite (PR:H) sharply narrows practical exposure to insiders or attackers who have already breached the highest privilege level; EPSS is 0.14% (34th percentile) and no public exploit has been identified at time of analysis. QNAP has released fixed builds QTS 5.2.6.3195 build 20250715 and QuTS hero h5.2.6.3195 build 20250715 and later.
Denial of service in QNAP QTS and QuTS hero can be triggered by a remote attacker who already holds a QNAP administrator account, causing a NULL pointer dereference that affects availability. The CVSS 4.0 base score is 5.1 with PR:H, AC:L, UI:N, and availability-only impact; there is no data exposure or code execution. Vendor patches are available in QTS 5.2.6.3195 build 20250715 and later and QuTS hero h5.2.6.3195 build 20250715 or h5.3.0.3192 build 20250716 and later; no public exploit was identified at time of analysis, and EPSS is low at 0.14% (34th percentile).
Sensitive-data disclosure and memory modification in QNAP QTS 5.2.x and QuTS hero h5.2.x stem from an externally controlled format string (CWE-134) that is reachable over the network but requires a valid administrator account; once that prerequisite is met, an attacker can read secret data or manipulate process memory with low complexity and no user interaction. The vendor fixed the issue in QTS 5.2.6.3195 build 20250715 and QuTS hero h5.2.6.3195 build 20250715, EPSS is 0.05% (16th percentile), and no public exploit code or CISA KEV entry was identified at time of analysis.
NULL pointer dereference in QNAP QTS 5.2.x allows an attacker who already holds a valid administrator account to crash or destabilize the NAS and cause a denial-of-service condition. The flaw is network-reachable and requires no user interaction, but the administrative-credential prerequisite sharply limits exposure to insiders or attackers who have already compromised the admin layer; impact is availability-only. No public exploit code or CISA KEV entry was identified, EPSS is low at 0.14% (34th percentile), and QNAP has released fixed builds starting with QTS 5.2.6.3195 build 20250715; given the admin prerequisite and availability-only impact, this is a low-to-moderate priority item unlikely to warrant emergency patching.
QNAP QTS and QuTS hero contain a NULL pointer dereference that can be triggered by a remote attacker with an administrator account, resulting in a low-impact denial-of-service condition. Affected devices are QTS 5.2.x and QuTS hero h5.2.x before build 20250715, and the vendor has released QTS 5.2.6.3195 and QuTS hero h5.2.6.3195 (build 20250715). No public exploit code or confirmed active exploitation was identified in the provided intelligence, and EPSS is low at 0.14%.
Authenticated denial of service in QNAP QTS 5.2.x and QuTS hero h5.2.x: a remote attacker who already holds an administrator account on the NAS can trigger a NULL pointer dereference that disrupts service on the appliance. Exploitation requires the highest privilege level (CVSS PR:H) over the network against the management plane, and the resulting impact is limited to availability; there is no confidentiality or integrity loss. QNAP has released fixed builds (QTS 5.2.6.3195 build 20250715 and QuTS hero h5.2.6.3195 build 20250715), EPSS is low at roughly 0.14% (34th percentile), and no public exploit code or confirmed active exploitation was identified at time of analysis.
A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. [CVSS 6.5 MEDIUM]
A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. [CVSS 6.5 MEDIUM]
A buffer overflow vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. [CVSS 8.1 HIGH]
A buffer overflow vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. [CVSS 8.1 HIGH]
A buffer overflow vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. [CVSS 8.1 HIGH]
A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. [CVSS 8.1 HIGH]
A buffer overflow vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. [CVSS 8.1 HIGH]
A buffer overflow vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. [CVSS 8.1 HIGH]
A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. [CVSS 6.5 MEDIUM]
A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. [CVSS 6.5 MEDIUM]
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. [CVSS 4.9 MEDIUM]
An out-of-bounds write vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to modify or corrupt memory. [CVSS 8.8 HIGH]
A use of externally-controlled format string vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to obtain secret data or modify memory. [CVSS 8.1 HIGH]
A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. [CVSS 6.5 MEDIUM]
A command injection vulnerability has been reported to affect Media Streaming add-on. If an attacker gains local network access who have also gained a user account, they can then exploit the vulnerability to execute arbitrary commands. [CVSS 7.8 HIGH]
An out-of-bounds read vulnerability has been reported to affect Media Streaming add-on. If an attacker gains local network access, they can then exploit the vulnerability to obtain secret data. [CVSS 5.5 MEDIUM]
An exposure of sensitive system information to an unauthorized control sphere vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to read application data. [CVSS 7.5 HIGH]
A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to modify memory or crash processes. [CVSS 6.5 MEDIUM]
An external control of file name or path vulnerability has been reported to affect HBS 3 Hybrid Backup Sync. If an attacker gains local network access, they can then exploit the vulnerability to read or modify files or directories. [CVSS 7.8 HIGH]
Information disclosure in QNAP Hybrid Backup Sync (HBS 3) prior to 26.2.0.938 allows an attacker with local network access or physical proximity to a QNAP NAS appliance to read application data through generated error messages that contain sensitive information. Exploitation requires no authentication once proximity is obtained and no user interaction, but it is not reachable by remote internet-based attackers; impact is confined to confidentiality, not code execution or data modification. No public exploit identified at time of analysis, and EPSS is low at 0.02% (4th percentile).
SQL injection in QNAP Hyper Data Protector allows unauthenticated remote attackers to execute unauthorized code or commands on affected QNAP NAS devices. The flaw affects versions prior to 2.2.4.1, which is the vendor-released patch. No public exploit code has been identified at time of analysis, and the EPSS score is low at 0.12%, though the vulnerability carries a high severity rating due to the potential for complete compromise of confidentiality, integrity, and availability.
Unauthenticated SQL injection in QNAP MARS (Multi-Application Recovery Service) versions prior to 1.2.1.1686 allows remote attackers to execute unauthorized code or commands, as reported by QNAP. The vulnerability is network-reachable with no authentication or user interaction required (CVSS 4.0 base score 8.1, High), and the vendor has released a patch in version 1.2.1.1686. EPSS score is 0.16% (36th percentile), indicating low likelihood of exploitation; no public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated path traversal in QNAP Qfiling 3.13.0 allows remote attackers who can reach the application's web interface on a QNAP NAS to read files and system data outside the intended Qfiling directories, including content accessible to the Qfiling service account. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms the flaw is exploitable remotely with no authentication, privileges, or user interaction, and the vendor reports it fixed in Qfiling 3.13.1 and later. No public exploit code has been identified at time of analysis and the EPSS score is negligible (0.07%, ~22nd percentile), so real-world priority is moderate rather than emergency; exposure is limited to NAS devices that actually have the optional Qfiling application installed and network-reachable.
A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. [CVSS 4.9 MEDIUM]
A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. [CVSS 4.9 MEDIUM]
A buffer overflow vulnerability has been reported to affect License Center. If a remote attacker gains an administrator account, they can then exploit the vulnerability to modify memory or crash processes. [CVSS 6.5 MEDIUM]
An out-of-bounds read vulnerability has been reported to affect License Center. If a remote attacker gains a user account, they can then exploit the vulnerability to obtain secret data. [CVSS 6.5 MEDIUM]
A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to modify memory or crash processes. [CVSS 6.5 MEDIUM]
QNAP Malware Remover before 6.6.8.20251023 has a code generation vulnerability that allows remote attackers to bypass the protection mechanism. An ironic vulnerability in a security tool that is supposed to protect QNAP NAS devices.
A cross-site scripting (XSS) vulnerability has been reported to affect QuMagie. The remote attackers can then exploit the vulnerability to bypass security mechanisms or read application data. [CVSS 6.1 MEDIUM]
An allocation of resources without limits or throttling vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource. We have already fixed the vulnerability in the following versions: QTS 5.2.7.3256 build 20250913 and later QuTS hero h5.2.7.3256 build 20250913 and later QuTS hero h5.3.1...
An out-of-bounds read vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret data. [CVSS 4.9 MEDIUM]
An out-of-bounds read vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret data. [CVSS 4.9 MEDIUM]
An out-of-bounds read vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret data. [CVSS 4.9 MEDIUM]
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. [CVSS 4.9 MEDIUM]
A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to modify memory or crash processes. [CVSS 6.5 MEDIUM]
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. [CVSS 6.5 MEDIUM]
Quts Hero versions up to h5.2.0.2737 is affected by use of externally-controlled format string (CVSS 6.5).
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. [CVSS 4.9 MEDIUM]
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. [CVSS 4.9 MEDIUM]
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. [CVSS 4.9 MEDIUM]
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. [CVSS 4.9 MEDIUM]
A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. [CVSS 8.1 HIGH]
A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. [CVSS 8.1 HIGH]
A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. [CVSS 8.1 HIGH]
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. [CVSS 4.9 MEDIUM]
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. [CVSS 4.9 MEDIUM]
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. [CVSS 4.9 MEDIUM]
Quts Hero versions up to h5.2.0.2737 is affected by allocation of resources without limits or throttling (CVSS 6.5).
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. [CVSS 6.5 MEDIUM]
SQL injection in QNAP QTS and QuTS hero NAS operating systems lets remote, unauthenticated attackers run unauthorized code or commands, but only when a specific precondition on the target holds and a legitimate user is drawn into some passive interaction, so it is not reliably exploitable against an arbitrary default deployment. Affected builds span QTS 5.2.0.x through 5.2.3.3006 and the corresponding QuTS hero releases prior to the October 2025 fixes; the exact injectable feature or endpoint is not disclosed in the available data. No public exploit code was identified at time of analysis and CISA KEV does not list this CVE, while EPSS places it at roughly 0.97% (61st percentile) - a moderate-priority issue rather than a critical emergency, with the strongest real-world risk falling on internet-exposed NAS management interfaces.
Denial-of-service through a NULL pointer dereference in QNAP QTS 5.2.x and QuTS hero allows remote, unauthenticated attackers to crash affected NAS services by sending crafted requests. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms network reachability and no authentication or user interaction are required; the independent assessment scores this as availability-only impact (CVSS 3.1 A:H), so exploitation results in service disruption rather than code execution or data compromise. No public exploit code has been identified at time of analysis, and EPSS/KEV data were not provided; the practical risk is driven almost entirely by whether the NAS management or service interfaces are exposed to untrusted networks. QNAP has released fixed builds, so unpatched, internet-facing appliances are the primary exposure.
Unauthenticated remote argument injection (CWE-88) in QNAP's QTS and QuTS hero NAS operating systems lets attackers alter command execution logic on reachable devices, yielding a high-integrity-loss but no-confidentiality or availability impact. Affected builds are QTS 5.2.x prior to 5.2.7.3297 build 20251024 and QuTS hero prior to h5.2.7.3297 / h5.3.1.3292 build 20251024; per the CVSS 4.0 vector, no privileges, user interaction, or special conditions are required, making internet-exposed NAS the highest-risk deployments. No public exploit code has been identified at time of analysis and the flaw is not in CISA KEV; EPSS is 0.82% (56th percentile), indicating low but non-trivial predicted exploitation activity.
Authentication bypass by spoofing in QNAP QTS and QuTS hero lets unauthenticated remote attackers reach resources that should require a valid login, yielding high confidentiality, integrity, and availability impact per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Affected systems are QTS builds from 5.2.0.x through 5.2.3.x and the corresponding QuTS hero releases prior to the 20251024 fix builds. No public exploit code has been identified at time of analysis and the CVE is not on the CISA KEV catalog, but the unauthenticated network vector combined with the frequent internet exposure of NAS management interfaces makes this a high-priority patching item; QNAP has released fixed firmware.
Photo Station 5.4.1 & 5.2.7 include the security fix for the vulnerability related to the XMR mining programs identified by internal research. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A cross-site request forgery (CSRF) vulnerability has been reported to affect QuLog Center. Rated low severity (CVSS 1.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A cross-site scripting (XSS) vulnerability has been reported to affect Download Station. Rated low severity (CVSS 2.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A relative path traversal vulnerability has been reported to affect QuMagie. Rated high severity (CVSS 7.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A relative path traversal vulnerability has been reported to affect Download Station. Rated low severity (CVSS 2.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A path traversal vulnerability has been reported to affect Qsync Central. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A cross-site scripting (XSS) vulnerability has been reported to affect File Station 5. Rated low severity (CVSS 2.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A cross-site scripting (XSS) vulnerability has been reported to affect QuLog Center. Rated low severity (CVSS 2.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A NULL pointer dereference vulnerability has been reported to affect File Station 5. Rated low severity (CVSS 0.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. Rated low severity (CVSS 1.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A NULL pointer dereference vulnerability has been reported to affect File Station 5. Rated low severity (CVSS 1.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A NULL pointer dereference vulnerability has been reported to affect File Station 5. Rated low severity (CVSS 1.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An SQL injection vulnerability has been reported to affect QuMagie. Rated critical severity (CVSS 9.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A NULL pointer dereference vulnerability has been reported to affect several product versions. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
NetBak Replicator 4.5.x on Windows allows an authenticated local user to execute arbitrary code via an unquoted search path, resulting in local privilege escalation. The flaw (CWE-428) affects versions before 4.5.15.0807 and requires an existing low-privileged account; execution occurs when the affected service or process starts or restarts, not instantaneously. No public exploit identified at time of analysis, and EPSS is low at 0.02%, though the vendor rates the issue High with a CVSS 4.0 score of 8.5.
Improper authentication in QNAP Authenticator 1.3.x before 1.3.1.1227 lets an unauthenticated attacker who gains physical access to the device running the mobile/companion app subvert authentication and compromise the security of the authenticator installation. The flaw is not remotely exploitable, requires passive user interaction, and is assessed as low-to-moderate real-world risk despite a 6.9 Medium CVSS 4.0 score; EPSS is 0.06% (20th percentile), and no public exploit or CISA KEV entry is identified. QNAP has released a fixed build, 1.3.1.1227 and later.
A use of externally-controlled format string (CWE-134) in QNAP QTS and QuTS hero 5.2.x lets an attacker who already holds a QNAP administrator account pass crafted format specifiers into a logging or string-handling routine, potentially disclosing secret data or corrupting process memory on the NAS. Exploitation is gated by the admin-credential prerequisite (PR:H) and the assessed impact is limited to low confidentiality and integrity loss with no availability effect, so realistic exposure comes from insiders, stolen admin credentials, or post-compromise abuse rather than opportunistic remote attacks. EPSS is 0.05% (16th percentile), no public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV; QNAP has released fixed builds in QTS 5.2.6.3195 build 20250715 and QuTS hero h5.2.6.3195 build 20250715.
QNAP QTS and QuTS hero contain a format-string vulnerability that an attacker holding administrator credentials can exploit remotely to read sensitive data or modify memory. Affected are QTS 5.2.x before 5.2.6.3195 build 20250715 and QuTS hero h5.2.x before h5.2.6.3195 build 20250715; patched builds are not vulnerable. Risk is moderate because the administrator-account prerequisite limits exploitation, EPSS is 0.05%, and no public exploit or CISA KEV entry was identified at time of analysis.
Privileged denial-of-service in QNAP QTS and QuTS hero 5.2.x allows a remote attacker who already holds a working administrator account to trigger a NULL pointer dereference and degrade or interrupt the affected NAS service. Only devices running QTS or QuTS hero builds prior to 5.2.6.3195 build 20250715 are affected, and the high privilege prerequisite (PR:H) sharply limits the realistic attacker population to insiders or parties who have already stolen admin credentials. EPSS is low at 0.14% (34th percentile), and no public exploit code has been identified at time of analysis; QNAP has released fixed builds under advisory QSA-25-36.
Denial of service in QNAP QTS and QuTS hero 5.2.x allows a remote attacker who already holds a valid administrator account to crash affected NAS systems by triggering a NULL pointer dereference. The issue is network-reachable with low attack complexity but is gated by the high-privilege requirement, so only authenticated administrative users can exploit it, and impact is limited to availability. QNAP has released fixed builds and no public exploit or active exploitation is identified at time of analysis; EPSS is 0.14% (34th percentile), consistent with low observed risk.
A NULL pointer dereference in QNAP QTS and QuTS hero 5.2.x allows an attacker who already holds a valid administrator account on the NAS to trigger a denial-of-service condition over the network, causing the affected service or system to crash. Because the CVSS vector requires high privileges (PR:H) and impact is limited to availability (A:L), the practical risk is confined to post-compromise or insider scenarios rather than opportunistic remote attack; EPSS is just 0.14% (34th percentile) and no public exploit or CISA KEV entry is associated with the flaw. QNAP has released fixed builds (QTS 5.2.6.3195 and QuTS hero h5.2.6.3195, build 20250715) that eliminate the vulnerability.
Privileged denial-of-service in QNAP QTS and QuTS hero lets an attacker who already holds an administrator account crash affected NAS services by triggering a NULL pointer dereference. QTS 5.2.x and QuTS hero h5.2.x before 5.2.6.3195 build 20250715 are affected; impact is availability-only and requires high privileges, and no public exploit has been identified at time of analysis (EPSS 0.14%).
Authenticated administrator-level denial of service in QNAP QTS and QuTS hero allows a remote attacker with a valid administrator account to trigger a NULL pointer dereference and crash or degrade the affected NAS service. Affected builds are QTS 5.2.x before 5.2.6.3195 build 20250715 and QuTS hero h5.2.x before h5.2.6.3195 build 20250715, and the vendor has released fixed builds. Despite a 5.1 MEDIUM CVSS 4.0 score, the administrator-privilege prerequisite and availability-only impact make this a low-priority issue; no public exploit identified at time of analysis, no CISA KEV entry, and EPSS is 0.14% (34th percentile).
A NULL pointer dereference in QNAP QTS and QuTS hero 5.2.x (prior to builds 5.2.6.3195 / h5.2.6.3195 of 20250715) allows a remote attacker who already holds a QNAP administrator account to crash or destabilize the device, producing a denial-of-service condition limited to availability impact. The PR:H prerequisite is the dominant limiting factor: only insiders, credential thieves, or attackers chaining a separate authentication bypass can reach the flaw, and no public exploit code or active exploitation (CISA KEV) is associated with it. EPSS is 0.14% (34th percentile), and the vendor has released fixed builds, making this a low-priority, patching-hygiene issue rather than an urgent exposure.
A denial-of-service condition exists in the QNAP QTS and QuTS hero NAS operating systems, where a NULL pointer dereference can be triggered by an attacker who already holds a valid administrator account on the device, crashing the affected service. Only builds prior to QTS 5.2.6.3195 build 20250715 and QuTS hero h5.2.6.3195 build 20250715 are vulnerable, and the mandatory administrative privilege (PR:H) is the dominant limiting factor, confining realistic exploitation to insiders or attackers who have already compromised admin credentials. No public exploit code has been identified at time of analysis and EPSS is low at 0.14% (34th percentile), consistent with an availability-only impact and a high-privilege prerequisite.
Denial of service in QNAP QTS and QuTS hero 5.2.x allows an attacker who already holds a QNAP administrator account to crash the device or service by triggering a NULL pointer dereference. Affected deployments are QTS before 5.2.6.3195 build 20250715 and QuTS hero before h5.2.6.3195 build 20250715; the vector is network-reachable, but PR:H is the central limiting prerequisite. EPSS is 0.14% (34th percentile), no public exploit identified at time of analysis, and QNAP has released fixed builds; overall risk is low-priority and confined to environments where an administrator account is already malicious or compromised.
A post-authentication NULL pointer dereference in QNAP QTS and QuTS hero 5.2.x lets a remote attacker who already holds a valid administrator account crash the device management plane, causing a denial-of-service condition with no confidentiality or integrity impact. The administrative privilege prerequisite (CVSS PR:H) is the hard limiting factor: without admin credentials the flaw cannot be reached, so realistic exploitation is confined to attackers who have already compromised or been granted admin access. No public exploit code and no CISA KEV listing were identified at time of analysis, and EPSS is low at 0.14% (34th percentile); this is a medium-severity, low-priority issue in practice, and vendor fixes are already available.
Denial of service in QNAP QTS and QuTS hero 5.2.x stems from a NULL pointer dereference that an attacker can trigger only after obtaining a valid administrator account, producing a limited availability impact rather than code execution or data compromise. The administrator-credential prerequisite (PR:H) sharply narrows practical exposure to insiders or attackers who have already breached the highest privilege level; EPSS is 0.14% (34th percentile) and no public exploit has been identified at time of analysis. QNAP has released fixed builds QTS 5.2.6.3195 build 20250715 and QuTS hero h5.2.6.3195 build 20250715 and later.
Denial of service in QNAP QTS and QuTS hero can be triggered by a remote attacker who already holds a QNAP administrator account, causing a NULL pointer dereference that affects availability. The CVSS 4.0 base score is 5.1 with PR:H, AC:L, UI:N, and availability-only impact; there is no data exposure or code execution. Vendor patches are available in QTS 5.2.6.3195 build 20250715 and later and QuTS hero h5.2.6.3195 build 20250715 or h5.3.0.3192 build 20250716 and later; no public exploit was identified at time of analysis, and EPSS is low at 0.14% (34th percentile).
Sensitive-data disclosure and memory modification in QNAP QTS 5.2.x and QuTS hero h5.2.x stem from an externally controlled format string (CWE-134) that is reachable over the network but requires a valid administrator account; once that prerequisite is met, an attacker can read secret data or manipulate process memory with low complexity and no user interaction. The vendor fixed the issue in QTS 5.2.6.3195 build 20250715 and QuTS hero h5.2.6.3195 build 20250715, EPSS is 0.05% (16th percentile), and no public exploit code or CISA KEV entry was identified at time of analysis.
NULL pointer dereference in QNAP QTS 5.2.x allows an attacker who already holds a valid administrator account to crash or destabilize the NAS and cause a denial-of-service condition. The flaw is network-reachable and requires no user interaction, but the administrative-credential prerequisite sharply limits exposure to insiders or attackers who have already compromised the admin layer; impact is availability-only. No public exploit code or CISA KEV entry was identified, EPSS is low at 0.14% (34th percentile), and QNAP has released fixed builds starting with QTS 5.2.6.3195 build 20250715; given the admin prerequisite and availability-only impact, this is a low-to-moderate priority item unlikely to warrant emergency patching.
QNAP QTS and QuTS hero contain a NULL pointer dereference that can be triggered by a remote attacker with an administrator account, resulting in a low-impact denial-of-service condition. Affected devices are QTS 5.2.x and QuTS hero h5.2.x before build 20250715, and the vendor has released QTS 5.2.6.3195 and QuTS hero h5.2.6.3195 (build 20250715). No public exploit code or confirmed active exploitation was identified in the provided intelligence, and EPSS is low at 0.14%.
Authenticated denial of service in QNAP QTS 5.2.x and QuTS hero h5.2.x: a remote attacker who already holds an administrator account on the NAS can trigger a NULL pointer dereference that disrupts service on the appliance. Exploitation requires the highest privilege level (CVSS PR:H) over the network against the management plane, and the resulting impact is limited to availability; there is no confidentiality or integrity loss. QNAP has released fixed builds (QTS 5.2.6.3195 build 20250715 and QuTS hero h5.2.6.3195 build 20250715), EPSS is low at roughly 0.14% (34th percentile), and no public exploit code or confirmed active exploitation was identified at time of analysis.