Qts
Monthly
Authenticated command injection in QNAP QTS and QuTS hero NAS operating systems allows attackers with administrator credentials to execute arbitrary OS commands on the appliance. The flaw spans multiple QTS and QuTS hero release trains (5.2.x, 5.3.x, and 6.0.x) and has been patched by QNAP across all affected branches. No public exploit identified at time of analysis, and the vulnerability is not currently listed in CISA KEV, but the post-authentication code execution primitive is highly valuable for attackers who have already harvested admin credentials.
This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
QNAP has patched a remote code execution vulnerability affecting the QTS Media Library in all versions prior to QTS 4.2.6 build 20170905 and QTS 4.3.3.0299 build 20170901. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 51.1%.
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Authenticated command injection in QNAP QTS and QuTS hero NAS operating systems allows an attacker who already holds an administrator account to execute arbitrary OS commands on the appliance. The flaw carries a CVSS 4.0 score of 8.6, but the PR:H requirement substantially narrows the attacker population; no public exploit identified at time of analysis and the issue is not listed in CISA KEV. QNAP has shipped fixed builds (QTS 5.2.9.3492 build 20260507 and QuTS hero h5.2.9.3499 build 20260514).
Path traversal in QNAP QTS and QuTS hero NAS operating systems exposes arbitrary file contents to attackers who have already obtained administrator-level access. The root cause (CWE-22) indicates insufficient sanitization of file path inputs, allowing directory escape to reach files outside intended scope. No public exploit code has been identified at time of analysis, and CISA KEV lists no active exploitation - making this a targeted post-compromise risk rather than an opportunistic mass-exploitation scenario. Vendor-released patches address all affected branches as of May 2026.
NULL pointer dereference in QNAP QTS and QuTS hero NAS operating systems enables a remote, administrator-authenticated attacker to trigger a denial-of-service condition. Exploitation requires the attacker to first hold or acquire an administrator account on the target device, after which a crafted request can crash system services. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
NULL pointer dereference in QNAP QTS and QuTS hero NAS operating systems allows remote unauthenticated attackers to crash a network-facing service and cause a denial-of-service condition without any authentication or user interaction. Multiple active OS branches are affected - QTS 5.2.x and QuTS hero h5.2.x through h6.0.x - across a device population that is historically internet-exposed and frequently targeted. No public exploit has been identified and this vulnerability is not listed in CISA KEV, but the zero-authentication, network-accessible attack surface makes DoS attempts trivially repeatable against unpatched devices.
Integer overflow (CWE-190) in QNAP QTS and QuTS hero NAS operating systems allows a remote attacker who has already obtained an administrator account to further compromise system integrity and availability. Affected versions span QTS 5.2.x and QuTS hero h5.2.x through h6.0.x; QNAP released patched builds in February and May 2026. No public exploit code and no CISA KEV listing have been identified at time of analysis, and the mandatory prerequisite of administrator-level access materially constrains real-world exploitability.
Authenticated command injection in QNAP QTS and QuTS hero allows a remote attacker holding administrator credentials to execute arbitrary OS commands on the NAS appliance. The CVSS 4.0 base score of 8.6 reflects high impact across confidentiality, integrity, and availability, though exploitation requires high privileges (PR:H). No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV; QNAP has released fixed builds across affected QTS and QuTS hero branches.
Authenticated command injection in QNAP QTS and QuTS hero NAS operating systems allows a remote attacker who has already obtained administrator credentials to execute arbitrary OS commands on the appliance. Reported by QNAP itself and tracked as EUVD-2025-210099, the issue affects multiple branches across QTS 5.2.x and QuTS hero 5.2.x, 5.3.x, and 6.0.x and is fixed in builds dated 2026-02-06 through 2026-05-20. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
External control of assumed-immutable web parameters in QNAP NAS software enables remote unauthenticated attackers to achieve low-integrity impact by manipulating parameters the application treats as unmodifiable. The vulnerability requires active user interaction to trigger, limiting opportunistic exploitation. QNAP has released a fix per advisory QSA-26-10; no public exploit code or CISA KEV listing has been identified at time of analysis.
High-severity information disclosure flaw in QNAP QTS NAS operating system versions 5.2.0 through 5.2.7.3256 build 20250913 allows remote unauthenticated attackers to obtain sensitive data over the network with low attack complexity, per CVSS v4.0 vector AV:N/AC:L/PR:N/UI:N rating 9.2. The vendor has released a fix, and notably QuTS hero is explicitly unaffected. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Stack-based buffer overflow in QNAP QTS and QuTS hero NAS operating systems enables an authenticated administrator to corrupt stack memory or crash processes via a network-accessible attack path. Affected versions span QTS 5.2.x and multiple QuTS hero release trains (h5.2.x, h5.3.x, h6.0.x), with vendor-released patches dated February-May 2026. No public exploit code and no CISA KEV listing have been identified at time of analysis, and the mandatory high-privilege prerequisite substantially limits realistic attack surface.
Cross-site scripting in QNAP QTS and QuTS hero operating systems allows remote attackers to bypass security mechanisms and read application data when an authenticated user interacts with attacker-supplied content. The flaw carries a CVSS 4.0 score of 8.7 driven by network reachability, low attack complexity, no required privileges, and high impact across confidentiality, integrity, and availability of the NAS management surface. There is no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.
A command injection vulnerability has been reported to affect several QNAP operating system versions. If an attacker gains local network access who have also gained a user account, they can then exploit the vulnerability to execute arbitrary commands. [CVSS 7.8 HIGH]
Symlink following vulnerability in multiple QNAP NAS operating system versions allows remote attackers to exploit link resolution for unauthorized access.
A use of uninitialized variable vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to denial of service conditions, or modify control flow in unexpected ways. [CVSS 4.9 MEDIUM]
A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. [CVSS 8.1 HIGH]
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. [CVSS 4.9 MEDIUM]
An exposure of sensitive system information to an unauthorized control sphere vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to read application data. [CVSS 7.5 HIGH]
A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to modify memory or crash processes. [CVSS 6.5 MEDIUM]
A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. [CVSS 4.9 MEDIUM]
A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. [CVSS 4.9 MEDIUM]
A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to modify memory or crash processes. [CVSS 6.5 MEDIUM]
An allocation of resources without limits or throttling vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource. We have already fixed the vulnerability in the following versions: QTS 5.2.7.3256 build 20250913 and later QuTS hero h5.2.7.3256 build 20250913 and later QuTS hero h5.3.1...
An out-of-bounds read vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret data. [CVSS 4.9 MEDIUM]
An out-of-bounds read vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret data. [CVSS 4.9 MEDIUM]
An out-of-bounds read vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret data. [CVSS 4.9 MEDIUM]
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. [CVSS 4.9 MEDIUM]
A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to modify memory or crash processes. [CVSS 6.5 MEDIUM]
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. [CVSS 6.5 MEDIUM]
Quts Hero versions up to h5.2.0.2737 is affected by use of externally-controlled format string (CVSS 6.5).
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. [CVSS 4.9 MEDIUM]
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. [CVSS 4.9 MEDIUM]
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. [CVSS 4.9 MEDIUM]
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. [CVSS 4.9 MEDIUM]
A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. [CVSS 8.1 HIGH]
A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. [CVSS 8.1 HIGH]
A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. [CVSS 8.1 HIGH]
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. [CVSS 4.9 MEDIUM]
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. [CVSS 4.9 MEDIUM]
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. [CVSS 4.9 MEDIUM]
Quts Hero versions up to h5.2.0.2737 is affected by allocation of resources without limits or throttling (CVSS 6.5).
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. [CVSS 6.5 MEDIUM]
SQL injection in QNAP QTS and QuTS hero NAS operating systems lets remote, unauthenticated attackers run unauthorized code or commands, but only when a specific precondition on the target holds and a legitimate user is drawn into some passive interaction, so it is not reliably exploitable against an arbitrary default deployment. Affected builds span QTS 5.2.0.x through 5.2.3.3006 and the corresponding QuTS hero releases prior to the October 2025 fixes; the exact injectable feature or endpoint is not disclosed in the available data. No public exploit code was identified at time of analysis and CISA KEV does not list this CVE, while EPSS places it at roughly 0.97% (61st percentile) - a moderate-priority issue rather than a critical emergency, with the strongest real-world risk falling on internet-exposed NAS management interfaces.
Denial-of-service through a NULL pointer dereference in QNAP QTS 5.2.x and QuTS hero allows remote, unauthenticated attackers to crash affected NAS services by sending crafted requests. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms network reachability and no authentication or user interaction are required; the independent assessment scores this as availability-only impact (CVSS 3.1 A:H), so exploitation results in service disruption rather than code execution or data compromise. No public exploit code has been identified at time of analysis, and EPSS/KEV data were not provided; the practical risk is driven almost entirely by whether the NAS management or service interfaces are exposed to untrusted networks. QNAP has released fixed builds, so unpatched, internet-facing appliances are the primary exposure.
Unauthenticated remote argument injection (CWE-88) in QNAP's QTS and QuTS hero NAS operating systems lets attackers alter command execution logic on reachable devices, yielding a high-integrity-loss but no-confidentiality or availability impact. Affected builds are QTS 5.2.x prior to 5.2.7.3297 build 20251024 and QuTS hero prior to h5.2.7.3297 / h5.3.1.3292 build 20251024; per the CVSS 4.0 vector, no privileges, user interaction, or special conditions are required, making internet-exposed NAS the highest-risk deployments. No public exploit code has been identified at time of analysis and the flaw is not in CISA KEV; EPSS is 0.82% (56th percentile), indicating low but non-trivial predicted exploitation activity.
Authentication bypass by spoofing in QNAP QTS and QuTS hero lets unauthenticated remote attackers reach resources that should require a valid login, yielding high confidentiality, integrity, and availability impact per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Affected systems are QTS builds from 5.2.0.x through 5.2.3.x and the corresponding QuTS hero releases prior to the 20251024 fix builds. No public exploit code has been identified at time of analysis and the CVE is not on the CISA KEV catalog, but the unauthenticated network vector combined with the frequent internet exposure of NAS management interfaces makes this a high-priority patching item; QNAP has released fixed firmware.
A use of externally-controlled format string (CWE-134) in QNAP QTS and QuTS hero 5.2.x lets an attacker who already holds a QNAP administrator account pass crafted format specifiers into a logging or string-handling routine, potentially disclosing secret data or corrupting process memory on the NAS. Exploitation is gated by the admin-credential prerequisite (PR:H) and the assessed impact is limited to low confidentiality and integrity loss with no availability effect, so realistic exposure comes from insiders, stolen admin credentials, or post-compromise abuse rather than opportunistic remote attacks. EPSS is 0.05% (16th percentile), no public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV; QNAP has released fixed builds in QTS 5.2.6.3195 build 20250715 and QuTS hero h5.2.6.3195 build 20250715.
QNAP QTS and QuTS hero contain a format-string vulnerability that an attacker holding administrator credentials can exploit remotely to read sensitive data or modify memory. Affected are QTS 5.2.x before 5.2.6.3195 build 20250715 and QuTS hero h5.2.x before h5.2.6.3195 build 20250715; patched builds are not vulnerable. Risk is moderate because the administrator-account prerequisite limits exploitation, EPSS is 0.05%, and no public exploit or CISA KEV entry was identified at time of analysis.
Privileged denial-of-service in QNAP QTS and QuTS hero 5.2.x allows a remote attacker who already holds a working administrator account to trigger a NULL pointer dereference and degrade or interrupt the affected NAS service. Only devices running QTS or QuTS hero builds prior to 5.2.6.3195 build 20250715 are affected, and the high privilege prerequisite (PR:H) sharply limits the realistic attacker population to insiders or parties who have already stolen admin credentials. EPSS is low at 0.14% (34th percentile), and no public exploit code has been identified at time of analysis; QNAP has released fixed builds under advisory QSA-25-36.
Denial of service in QNAP QTS and QuTS hero 5.2.x allows a remote attacker who already holds a valid administrator account to crash affected NAS systems by triggering a NULL pointer dereference. The issue is network-reachable with low attack complexity but is gated by the high-privilege requirement, so only authenticated administrative users can exploit it, and impact is limited to availability. QNAP has released fixed builds and no public exploit or active exploitation is identified at time of analysis; EPSS is 0.14% (34th percentile), consistent with low observed risk.
A NULL pointer dereference in QNAP QTS and QuTS hero 5.2.x allows an attacker who already holds a valid administrator account on the NAS to trigger a denial-of-service condition over the network, causing the affected service or system to crash. Because the CVSS vector requires high privileges (PR:H) and impact is limited to availability (A:L), the practical risk is confined to post-compromise or insider scenarios rather than opportunistic remote attack; EPSS is just 0.14% (34th percentile) and no public exploit or CISA KEV entry is associated with the flaw. QNAP has released fixed builds (QTS 5.2.6.3195 and QuTS hero h5.2.6.3195, build 20250715) that eliminate the vulnerability.
Privileged denial-of-service in QNAP QTS and QuTS hero lets an attacker who already holds an administrator account crash affected NAS services by triggering a NULL pointer dereference. QTS 5.2.x and QuTS hero h5.2.x before 5.2.6.3195 build 20250715 are affected; impact is availability-only and requires high privileges, and no public exploit has been identified at time of analysis (EPSS 0.14%).
Authenticated administrator-level denial of service in QNAP QTS and QuTS hero allows a remote attacker with a valid administrator account to trigger a NULL pointer dereference and crash or degrade the affected NAS service. Affected builds are QTS 5.2.x before 5.2.6.3195 build 20250715 and QuTS hero h5.2.x before h5.2.6.3195 build 20250715, and the vendor has released fixed builds. Despite a 5.1 MEDIUM CVSS 4.0 score, the administrator-privilege prerequisite and availability-only impact make this a low-priority issue; no public exploit identified at time of analysis, no CISA KEV entry, and EPSS is 0.14% (34th percentile).
A NULL pointer dereference in QNAP QTS and QuTS hero 5.2.x (prior to builds 5.2.6.3195 / h5.2.6.3195 of 20250715) allows a remote attacker who already holds a QNAP administrator account to crash or destabilize the device, producing a denial-of-service condition limited to availability impact. The PR:H prerequisite is the dominant limiting factor: only insiders, credential thieves, or attackers chaining a separate authentication bypass can reach the flaw, and no public exploit code or active exploitation (CISA KEV) is associated with it. EPSS is 0.14% (34th percentile), and the vendor has released fixed builds, making this a low-priority, patching-hygiene issue rather than an urgent exposure.
A denial-of-service condition exists in the QNAP QTS and QuTS hero NAS operating systems, where a NULL pointer dereference can be triggered by an attacker who already holds a valid administrator account on the device, crashing the affected service. Only builds prior to QTS 5.2.6.3195 build 20250715 and QuTS hero h5.2.6.3195 build 20250715 are vulnerable, and the mandatory administrative privilege (PR:H) is the dominant limiting factor, confining realistic exploitation to insiders or attackers who have already compromised admin credentials. No public exploit code has been identified at time of analysis and EPSS is low at 0.14% (34th percentile), consistent with an availability-only impact and a high-privilege prerequisite.
Denial of service in QNAP QTS and QuTS hero 5.2.x allows an attacker who already holds a QNAP administrator account to crash the device or service by triggering a NULL pointer dereference. Affected deployments are QTS before 5.2.6.3195 build 20250715 and QuTS hero before h5.2.6.3195 build 20250715; the vector is network-reachable, but PR:H is the central limiting prerequisite. EPSS is 0.14% (34th percentile), no public exploit identified at time of analysis, and QNAP has released fixed builds; overall risk is low-priority and confined to environments where an administrator account is already malicious or compromised.
A post-authentication NULL pointer dereference in QNAP QTS and QuTS hero 5.2.x lets a remote attacker who already holds a valid administrator account crash the device management plane, causing a denial-of-service condition with no confidentiality or integrity impact. The administrative privilege prerequisite (CVSS PR:H) is the hard limiting factor: without admin credentials the flaw cannot be reached, so realistic exploitation is confined to attackers who have already compromised or been granted admin access. No public exploit code and no CISA KEV listing were identified at time of analysis, and EPSS is low at 0.14% (34th percentile); this is a medium-severity, low-priority issue in practice, and vendor fixes are already available.
Denial of service in QNAP QTS and QuTS hero 5.2.x stems from a NULL pointer dereference that an attacker can trigger only after obtaining a valid administrator account, producing a limited availability impact rather than code execution or data compromise. The administrator-credential prerequisite (PR:H) sharply narrows practical exposure to insiders or attackers who have already breached the highest privilege level; EPSS is 0.14% (34th percentile) and no public exploit has been identified at time of analysis. QNAP has released fixed builds QTS 5.2.6.3195 build 20250715 and QuTS hero h5.2.6.3195 build 20250715 and later.
Denial of service in QNAP QTS and QuTS hero can be triggered by a remote attacker who already holds a QNAP administrator account, causing a NULL pointer dereference that affects availability. The CVSS 4.0 base score is 5.1 with PR:H, AC:L, UI:N, and availability-only impact; there is no data exposure or code execution. Vendor patches are available in QTS 5.2.6.3195 build 20250715 and later and QuTS hero h5.2.6.3195 build 20250715 or h5.3.0.3192 build 20250716 and later; no public exploit was identified at time of analysis, and EPSS is low at 0.14% (34th percentile).
Sensitive-data disclosure and memory modification in QNAP QTS 5.2.x and QuTS hero h5.2.x stem from an externally controlled format string (CWE-134) that is reachable over the network but requires a valid administrator account; once that prerequisite is met, an attacker can read secret data or manipulate process memory with low complexity and no user interaction. The vendor fixed the issue in QTS 5.2.6.3195 build 20250715 and QuTS hero h5.2.6.3195 build 20250715, EPSS is 0.05% (16th percentile), and no public exploit code or CISA KEV entry was identified at time of analysis.
NULL pointer dereference in QNAP QTS 5.2.x allows an attacker who already holds a valid administrator account to crash or destabilize the NAS and cause a denial-of-service condition. The flaw is network-reachable and requires no user interaction, but the administrative-credential prerequisite sharply limits exposure to insiders or attackers who have already compromised the admin layer; impact is availability-only. No public exploit code or CISA KEV entry was identified, EPSS is low at 0.14% (34th percentile), and QNAP has released fixed builds starting with QTS 5.2.6.3195 build 20250715; given the admin prerequisite and availability-only impact, this is a low-to-moderate priority item unlikely to warrant emergency patching.
QNAP QTS and QuTS hero contain a NULL pointer dereference that can be triggered by a remote attacker with an administrator account, resulting in a low-impact denial-of-service condition. Affected devices are QTS 5.2.x and QuTS hero h5.2.x before build 20250715, and the vendor has released QTS 5.2.6.3195 and QuTS hero h5.2.6.3195 (build 20250715). No public exploit code or confirmed active exploitation was identified in the provided intelligence, and EPSS is low at 0.14%.
Authenticated denial of service in QNAP QTS 5.2.x and QuTS hero h5.2.x: a remote attacker who already holds an administrator account on the NAS can trigger a NULL pointer dereference that disrupts service on the appliance. Exploitation requires the highest privilege level (CVSS PR:H) over the network against the management plane, and the resulting impact is limited to availability; there is no confidentiality or integrity loss. QNAP has released fixed builds (QTS 5.2.6.3195 build 20250715 and QuTS hero h5.2.6.3195 build 20250715), EPSS is low at roughly 0.14% (34th percentile), and no public exploit code or confirmed active exploitation was identified at time of analysis.
Authenticated administrators on QNAP QTS and QuTS hero can exploit externally controlled format strings to disclose secret data or corrupt memory, but only after obtaining an existing administrator account. QTS 5.2.x before 5.2.6.3195 build 20250715 and QuTS hero h5.2.x before h5.2.6.3195 build 20250715 are affected; patched builds are not exploitable. EPSS is low at 0.05% (16th percentile) and no public exploit identified at time of analysis.
Denial of service in QNAP QTS and QuTS hero 5.2.x requires an attacker to already hold a valid administrator account; once authenticated, a crafted request to the network-reachable management service can trigger a NULL pointer dereference and disrupt the service. QNAP has released fixed builds, no public exploit code has been identified at time of analysis, and EPSS is low at 0.14%, so this is a genuine but low-priority issue constrained by the high-privilege prerequisite.
Denial-of-service conditions can be triggered in QNAP QTS and QuTS hero 5.2.x through a NULL pointer dereference that requires the attacker to already hold a valid administrator account on the target NAS. The flaw is network-reachable and needs no user interaction, but the administrator-credential precondition and availability-only impact keep practical risk low; EPSS is 0.14% and no public exploit identified at time of analysis. Vendor-released fixed builds are QTS 5.2.6.3195 build 20250715 and QuTS hero h5.2.6.3195 build 20250715 and later.
NULL pointer dereference in QNAP QTS and QuTS hero 5.2.x allows an attacker who already holds a valid administrator account to crash an affected NAS service, producing a denial-of-service condition with low availability impact. The CVSS base score is 5.1, but the high authentication prerequisite sharply limits practical risk; no public exploit code or CISA KEV entry was identified at time of analysis, and EPSS is low at 0.14%. Affected systems are QTS and QuTS hero builds below 5.2.6.3195 build 20250715.
Authenticated administrators on QNAP QTS and QuTS hero 5.2.x systems can trigger a NULL pointer dereference that crashes or destabilizes the NAS, producing a denial-of-service condition. The flaw affects QTS versions below 5.2.6.3195 build 20250715 and QuTS hero h5.2.x below h5.2.6.3195 build 20250715; fixed builds are available from QNAP. No public exploit code or confirmed active exploitation was identified, and EPSS is low at 0.14%, so practical risk is largely limited to environments where administrator credentials have already been compromised or are held by a malicious insider.
Denial of service in QNAP QTS 5.2.x can be triggered by a remote attacker who already holds a valid administrator account, causing a NULL pointer dereference in a network-reachable component and a limited availability impact. The flaw affects QTS builds prior to 5.2.6.3195 build 20250715 and is fixed in that release; EPSS is very low at 0.14% (34th percentile), and the supplied data contains no KEV entry and no public exploit identified at time of analysis. Because administrator access already confers full device control, practical risk is low and is mainly an availability outage through misuse or lateral abuse of stolen administrator credentials.
A NULL pointer dereference in QNAP QTS 5.2.x and QuTS hero h5.2.x allows an attacker who already holds a valid administrator account on the NAS to crash or destabilize the device, producing a limited denial-of-service condition. The management interface must be network-reachable, but no user interaction is required; the decisive limiting factor is the high-privilege prerequisite, which confines realistic exploitation to compromised-credential, insider, or post-exploitation scenarios rather than unauthenticated remote attack. No public exploit code or active exploitation has been identified, and EPSS is low at 0.14% (34th percentile), making this a genuinely low-priority issue despite the MEDIUM CVSS 4.0 score of 5.1.
Command injection in QNAP QTS 5.2.x and QuTS hero h5.2.x lets a remote attacker who already holds a valid administrator account run arbitrary commands on the NAS, yielding limited confidentiality, integrity, and availability impact. The administrator privilege requirement (PR:H) is the main limiting factor: this is a post-authentication, privileged-user flaw, not something an unauthenticated or low-privileged attacker can trigger. QNAP has released fixed builds (QTS 5.2.6.3195 build 20250715 and QuTS hero h5.2.6.3195 build 20250715); EPSS is low (0.13%, 32nd percentile) and there is no public exploit or KEV listing, making this a medium-severity, lower-priority issue rather than an urgent threat.
QNAP QTS and QuTS hero contain a path traversal flaw that lets an attacker who already holds an administrator account read files and system data outside the intended directory, with confidentiality-only impact and no write or denial-of-service effect. The issue affects QTS 5.2.x before 5.2.6.3195 build 20250715 and QuTS hero h5.2.x before h5.2.6.3195 build 20250715; vendor-released fixed builds are available. EPSS is low at 0.06% (17th percentile), no public exploit identified at time of analysis, and the administrator privilege prerequisite (PR:H) substantially limits real-world risk.
A path traversal vulnerability has been reported to affect several QNAP operating system versions. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An out-of-bounds write vulnerability has been reported to affect several QNAP operating system versions. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A path traversal vulnerability has been reported to affect several QNAP operating system versions. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A path traversal vulnerability has been reported to affect several QNAP operating system versions. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. Rated low severity (CVSS 2.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A command injection vulnerability has been reported to affect several QNAP operating system versions. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Command injection vulnerability affecting QNAP NAS operating systems (QTS and QuTS hero) that allows authenticated remote attackers to execute arbitrary commands with high severity (CVSS 8.8). The vulnerability requires valid user credentials but no user interaction, making it exploitable by compromised accounts or insider threats. QNAP has released patches as of March 21, 2025, and exploitation details are limited in public disclosures at this time.
A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained user access to modify memory or crash processes. We have already fixed the vulnerability in the following versions: QTS 5.2.4.3079 build 20250321 and later QuTS hero h5.2.4.3079 build 20250321 and later
An out-of-bounds write vulnerability has been reported to affect several QNAP operating system versions. Rated low severity (CVSS 2.1), this vulnerability is remotely exploitable. No vendor patch available.
Authenticated command injection in QNAP QTS and QuTS hero NAS operating systems allows attackers with administrator credentials to execute arbitrary OS commands on the appliance. The flaw spans multiple QTS and QuTS hero release trains (5.2.x, 5.3.x, and 6.0.x) and has been patched by QNAP across all affected branches. No public exploit identified at time of analysis, and the vulnerability is not currently listed in CISA KEV, but the post-authentication code execution primitive is highly valuable for attackers who have already harvested admin credentials.
This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
QNAP has patched a remote code execution vulnerability affecting the QTS Media Library in all versions prior to QTS 4.2.6 build 20170905 and QTS 4.3.3.0299 build 20170901. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 51.1%.
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Authenticated command injection in QNAP QTS and QuTS hero NAS operating systems allows an attacker who already holds an administrator account to execute arbitrary OS commands on the appliance. The flaw carries a CVSS 4.0 score of 8.6, but the PR:H requirement substantially narrows the attacker population; no public exploit identified at time of analysis and the issue is not listed in CISA KEV. QNAP has shipped fixed builds (QTS 5.2.9.3492 build 20260507 and QuTS hero h5.2.9.3499 build 20260514).
Path traversal in QNAP QTS and QuTS hero NAS operating systems exposes arbitrary file contents to attackers who have already obtained administrator-level access. The root cause (CWE-22) indicates insufficient sanitization of file path inputs, allowing directory escape to reach files outside intended scope. No public exploit code has been identified at time of analysis, and CISA KEV lists no active exploitation - making this a targeted post-compromise risk rather than an opportunistic mass-exploitation scenario. Vendor-released patches address all affected branches as of May 2026.
NULL pointer dereference in QNAP QTS and QuTS hero NAS operating systems enables a remote, administrator-authenticated attacker to trigger a denial-of-service condition. Exploitation requires the attacker to first hold or acquire an administrator account on the target device, after which a crafted request can crash system services. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
NULL pointer dereference in QNAP QTS and QuTS hero NAS operating systems allows remote unauthenticated attackers to crash a network-facing service and cause a denial-of-service condition without any authentication or user interaction. Multiple active OS branches are affected - QTS 5.2.x and QuTS hero h5.2.x through h6.0.x - across a device population that is historically internet-exposed and frequently targeted. No public exploit has been identified and this vulnerability is not listed in CISA KEV, but the zero-authentication, network-accessible attack surface makes DoS attempts trivially repeatable against unpatched devices.
Integer overflow (CWE-190) in QNAP QTS and QuTS hero NAS operating systems allows a remote attacker who has already obtained an administrator account to further compromise system integrity and availability. Affected versions span QTS 5.2.x and QuTS hero h5.2.x through h6.0.x; QNAP released patched builds in February and May 2026. No public exploit code and no CISA KEV listing have been identified at time of analysis, and the mandatory prerequisite of administrator-level access materially constrains real-world exploitability.
Authenticated command injection in QNAP QTS and QuTS hero allows a remote attacker holding administrator credentials to execute arbitrary OS commands on the NAS appliance. The CVSS 4.0 base score of 8.6 reflects high impact across confidentiality, integrity, and availability, though exploitation requires high privileges (PR:H). No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV; QNAP has released fixed builds across affected QTS and QuTS hero branches.
Authenticated command injection in QNAP QTS and QuTS hero NAS operating systems allows a remote attacker who has already obtained administrator credentials to execute arbitrary OS commands on the appliance. Reported by QNAP itself and tracked as EUVD-2025-210099, the issue affects multiple branches across QTS 5.2.x and QuTS hero 5.2.x, 5.3.x, and 6.0.x and is fixed in builds dated 2026-02-06 through 2026-05-20. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
External control of assumed-immutable web parameters in QNAP NAS software enables remote unauthenticated attackers to achieve low-integrity impact by manipulating parameters the application treats as unmodifiable. The vulnerability requires active user interaction to trigger, limiting opportunistic exploitation. QNAP has released a fix per advisory QSA-26-10; no public exploit code or CISA KEV listing has been identified at time of analysis.
High-severity information disclosure flaw in QNAP QTS NAS operating system versions 5.2.0 through 5.2.7.3256 build 20250913 allows remote unauthenticated attackers to obtain sensitive data over the network with low attack complexity, per CVSS v4.0 vector AV:N/AC:L/PR:N/UI:N rating 9.2. The vendor has released a fix, and notably QuTS hero is explicitly unaffected. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Stack-based buffer overflow in QNAP QTS and QuTS hero NAS operating systems enables an authenticated administrator to corrupt stack memory or crash processes via a network-accessible attack path. Affected versions span QTS 5.2.x and multiple QuTS hero release trains (h5.2.x, h5.3.x, h6.0.x), with vendor-released patches dated February-May 2026. No public exploit code and no CISA KEV listing have been identified at time of analysis, and the mandatory high-privilege prerequisite substantially limits realistic attack surface.
Cross-site scripting in QNAP QTS and QuTS hero operating systems allows remote attackers to bypass security mechanisms and read application data when an authenticated user interacts with attacker-supplied content. The flaw carries a CVSS 4.0 score of 8.7 driven by network reachability, low attack complexity, no required privileges, and high impact across confidentiality, integrity, and availability of the NAS management surface. There is no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.
A command injection vulnerability has been reported to affect several QNAP operating system versions. If an attacker gains local network access who have also gained a user account, they can then exploit the vulnerability to execute arbitrary commands. [CVSS 7.8 HIGH]
Symlink following vulnerability in multiple QNAP NAS operating system versions allows remote attackers to exploit link resolution for unauthorized access.
A use of uninitialized variable vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to denial of service conditions, or modify control flow in unexpected ways. [CVSS 4.9 MEDIUM]
A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. [CVSS 8.1 HIGH]
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. [CVSS 4.9 MEDIUM]
An exposure of sensitive system information to an unauthorized control sphere vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to read application data. [CVSS 7.5 HIGH]
A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to modify memory or crash processes. [CVSS 6.5 MEDIUM]
A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. [CVSS 4.9 MEDIUM]
A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. [CVSS 4.9 MEDIUM]
A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to modify memory or crash processes. [CVSS 6.5 MEDIUM]
An allocation of resources without limits or throttling vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource. We have already fixed the vulnerability in the following versions: QTS 5.2.7.3256 build 20250913 and later QuTS hero h5.2.7.3256 build 20250913 and later QuTS hero h5.3.1...
An out-of-bounds read vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret data. [CVSS 4.9 MEDIUM]
An out-of-bounds read vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret data. [CVSS 4.9 MEDIUM]
An out-of-bounds read vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret data. [CVSS 4.9 MEDIUM]
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. [CVSS 4.9 MEDIUM]
A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to modify memory or crash processes. [CVSS 6.5 MEDIUM]
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. [CVSS 6.5 MEDIUM]
Quts Hero versions up to h5.2.0.2737 is affected by use of externally-controlled format string (CVSS 6.5).
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. [CVSS 4.9 MEDIUM]
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. [CVSS 4.9 MEDIUM]
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. [CVSS 4.9 MEDIUM]
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. [CVSS 4.9 MEDIUM]
A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. [CVSS 8.1 HIGH]
A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. [CVSS 8.1 HIGH]
A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. [CVSS 8.1 HIGH]
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. [CVSS 4.9 MEDIUM]
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. [CVSS 4.9 MEDIUM]
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. [CVSS 4.9 MEDIUM]
Quts Hero versions up to h5.2.0.2737 is affected by allocation of resources without limits or throttling (CVSS 6.5).
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. [CVSS 6.5 MEDIUM]
SQL injection in QNAP QTS and QuTS hero NAS operating systems lets remote, unauthenticated attackers run unauthorized code or commands, but only when a specific precondition on the target holds and a legitimate user is drawn into some passive interaction, so it is not reliably exploitable against an arbitrary default deployment. Affected builds span QTS 5.2.0.x through 5.2.3.3006 and the corresponding QuTS hero releases prior to the October 2025 fixes; the exact injectable feature or endpoint is not disclosed in the available data. No public exploit code was identified at time of analysis and CISA KEV does not list this CVE, while EPSS places it at roughly 0.97% (61st percentile) - a moderate-priority issue rather than a critical emergency, with the strongest real-world risk falling on internet-exposed NAS management interfaces.
Denial-of-service through a NULL pointer dereference in QNAP QTS 5.2.x and QuTS hero allows remote, unauthenticated attackers to crash affected NAS services by sending crafted requests. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms network reachability and no authentication or user interaction are required; the independent assessment scores this as availability-only impact (CVSS 3.1 A:H), so exploitation results in service disruption rather than code execution or data compromise. No public exploit code has been identified at time of analysis, and EPSS/KEV data were not provided; the practical risk is driven almost entirely by whether the NAS management or service interfaces are exposed to untrusted networks. QNAP has released fixed builds, so unpatched, internet-facing appliances are the primary exposure.
Unauthenticated remote argument injection (CWE-88) in QNAP's QTS and QuTS hero NAS operating systems lets attackers alter command execution logic on reachable devices, yielding a high-integrity-loss but no-confidentiality or availability impact. Affected builds are QTS 5.2.x prior to 5.2.7.3297 build 20251024 and QuTS hero prior to h5.2.7.3297 / h5.3.1.3292 build 20251024; per the CVSS 4.0 vector, no privileges, user interaction, or special conditions are required, making internet-exposed NAS the highest-risk deployments. No public exploit code has been identified at time of analysis and the flaw is not in CISA KEV; EPSS is 0.82% (56th percentile), indicating low but non-trivial predicted exploitation activity.
Authentication bypass by spoofing in QNAP QTS and QuTS hero lets unauthenticated remote attackers reach resources that should require a valid login, yielding high confidentiality, integrity, and availability impact per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Affected systems are QTS builds from 5.2.0.x through 5.2.3.x and the corresponding QuTS hero releases prior to the 20251024 fix builds. No public exploit code has been identified at time of analysis and the CVE is not on the CISA KEV catalog, but the unauthenticated network vector combined with the frequent internet exposure of NAS management interfaces makes this a high-priority patching item; QNAP has released fixed firmware.
A use of externally-controlled format string (CWE-134) in QNAP QTS and QuTS hero 5.2.x lets an attacker who already holds a QNAP administrator account pass crafted format specifiers into a logging or string-handling routine, potentially disclosing secret data or corrupting process memory on the NAS. Exploitation is gated by the admin-credential prerequisite (PR:H) and the assessed impact is limited to low confidentiality and integrity loss with no availability effect, so realistic exposure comes from insiders, stolen admin credentials, or post-compromise abuse rather than opportunistic remote attacks. EPSS is 0.05% (16th percentile), no public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV; QNAP has released fixed builds in QTS 5.2.6.3195 build 20250715 and QuTS hero h5.2.6.3195 build 20250715.
QNAP QTS and QuTS hero contain a format-string vulnerability that an attacker holding administrator credentials can exploit remotely to read sensitive data or modify memory. Affected are QTS 5.2.x before 5.2.6.3195 build 20250715 and QuTS hero h5.2.x before h5.2.6.3195 build 20250715; patched builds are not vulnerable. Risk is moderate because the administrator-account prerequisite limits exploitation, EPSS is 0.05%, and no public exploit or CISA KEV entry was identified at time of analysis.
Privileged denial-of-service in QNAP QTS and QuTS hero 5.2.x allows a remote attacker who already holds a working administrator account to trigger a NULL pointer dereference and degrade or interrupt the affected NAS service. Only devices running QTS or QuTS hero builds prior to 5.2.6.3195 build 20250715 are affected, and the high privilege prerequisite (PR:H) sharply limits the realistic attacker population to insiders or parties who have already stolen admin credentials. EPSS is low at 0.14% (34th percentile), and no public exploit code has been identified at time of analysis; QNAP has released fixed builds under advisory QSA-25-36.
Denial of service in QNAP QTS and QuTS hero 5.2.x allows a remote attacker who already holds a valid administrator account to crash affected NAS systems by triggering a NULL pointer dereference. The issue is network-reachable with low attack complexity but is gated by the high-privilege requirement, so only authenticated administrative users can exploit it, and impact is limited to availability. QNAP has released fixed builds and no public exploit or active exploitation is identified at time of analysis; EPSS is 0.14% (34th percentile), consistent with low observed risk.
A NULL pointer dereference in QNAP QTS and QuTS hero 5.2.x allows an attacker who already holds a valid administrator account on the NAS to trigger a denial-of-service condition over the network, causing the affected service or system to crash. Because the CVSS vector requires high privileges (PR:H) and impact is limited to availability (A:L), the practical risk is confined to post-compromise or insider scenarios rather than opportunistic remote attack; EPSS is just 0.14% (34th percentile) and no public exploit or CISA KEV entry is associated with the flaw. QNAP has released fixed builds (QTS 5.2.6.3195 and QuTS hero h5.2.6.3195, build 20250715) that eliminate the vulnerability.
Privileged denial-of-service in QNAP QTS and QuTS hero lets an attacker who already holds an administrator account crash affected NAS services by triggering a NULL pointer dereference. QTS 5.2.x and QuTS hero h5.2.x before 5.2.6.3195 build 20250715 are affected; impact is availability-only and requires high privileges, and no public exploit has been identified at time of analysis (EPSS 0.14%).
Authenticated administrator-level denial of service in QNAP QTS and QuTS hero allows a remote attacker with a valid administrator account to trigger a NULL pointer dereference and crash or degrade the affected NAS service. Affected builds are QTS 5.2.x before 5.2.6.3195 build 20250715 and QuTS hero h5.2.x before h5.2.6.3195 build 20250715, and the vendor has released fixed builds. Despite a 5.1 MEDIUM CVSS 4.0 score, the administrator-privilege prerequisite and availability-only impact make this a low-priority issue; no public exploit identified at time of analysis, no CISA KEV entry, and EPSS is 0.14% (34th percentile).
A NULL pointer dereference in QNAP QTS and QuTS hero 5.2.x (prior to builds 5.2.6.3195 / h5.2.6.3195 of 20250715) allows a remote attacker who already holds a QNAP administrator account to crash or destabilize the device, producing a denial-of-service condition limited to availability impact. The PR:H prerequisite is the dominant limiting factor: only insiders, credential thieves, or attackers chaining a separate authentication bypass can reach the flaw, and no public exploit code or active exploitation (CISA KEV) is associated with it. EPSS is 0.14% (34th percentile), and the vendor has released fixed builds, making this a low-priority, patching-hygiene issue rather than an urgent exposure.
A denial-of-service condition exists in the QNAP QTS and QuTS hero NAS operating systems, where a NULL pointer dereference can be triggered by an attacker who already holds a valid administrator account on the device, crashing the affected service. Only builds prior to QTS 5.2.6.3195 build 20250715 and QuTS hero h5.2.6.3195 build 20250715 are vulnerable, and the mandatory administrative privilege (PR:H) is the dominant limiting factor, confining realistic exploitation to insiders or attackers who have already compromised admin credentials. No public exploit code has been identified at time of analysis and EPSS is low at 0.14% (34th percentile), consistent with an availability-only impact and a high-privilege prerequisite.
Denial of service in QNAP QTS and QuTS hero 5.2.x allows an attacker who already holds a QNAP administrator account to crash the device or service by triggering a NULL pointer dereference. Affected deployments are QTS before 5.2.6.3195 build 20250715 and QuTS hero before h5.2.6.3195 build 20250715; the vector is network-reachable, but PR:H is the central limiting prerequisite. EPSS is 0.14% (34th percentile), no public exploit identified at time of analysis, and QNAP has released fixed builds; overall risk is low-priority and confined to environments where an administrator account is already malicious or compromised.
A post-authentication NULL pointer dereference in QNAP QTS and QuTS hero 5.2.x lets a remote attacker who already holds a valid administrator account crash the device management plane, causing a denial-of-service condition with no confidentiality or integrity impact. The administrative privilege prerequisite (CVSS PR:H) is the hard limiting factor: without admin credentials the flaw cannot be reached, so realistic exploitation is confined to attackers who have already compromised or been granted admin access. No public exploit code and no CISA KEV listing were identified at time of analysis, and EPSS is low at 0.14% (34th percentile); this is a medium-severity, low-priority issue in practice, and vendor fixes are already available.
Denial of service in QNAP QTS and QuTS hero 5.2.x stems from a NULL pointer dereference that an attacker can trigger only after obtaining a valid administrator account, producing a limited availability impact rather than code execution or data compromise. The administrator-credential prerequisite (PR:H) sharply narrows practical exposure to insiders or attackers who have already breached the highest privilege level; EPSS is 0.14% (34th percentile) and no public exploit has been identified at time of analysis. QNAP has released fixed builds QTS 5.2.6.3195 build 20250715 and QuTS hero h5.2.6.3195 build 20250715 and later.
Denial of service in QNAP QTS and QuTS hero can be triggered by a remote attacker who already holds a QNAP administrator account, causing a NULL pointer dereference that affects availability. The CVSS 4.0 base score is 5.1 with PR:H, AC:L, UI:N, and availability-only impact; there is no data exposure or code execution. Vendor patches are available in QTS 5.2.6.3195 build 20250715 and later and QuTS hero h5.2.6.3195 build 20250715 or h5.3.0.3192 build 20250716 and later; no public exploit was identified at time of analysis, and EPSS is low at 0.14% (34th percentile).
Sensitive-data disclosure and memory modification in QNAP QTS 5.2.x and QuTS hero h5.2.x stem from an externally controlled format string (CWE-134) that is reachable over the network but requires a valid administrator account; once that prerequisite is met, an attacker can read secret data or manipulate process memory with low complexity and no user interaction. The vendor fixed the issue in QTS 5.2.6.3195 build 20250715 and QuTS hero h5.2.6.3195 build 20250715, EPSS is 0.05% (16th percentile), and no public exploit code or CISA KEV entry was identified at time of analysis.
NULL pointer dereference in QNAP QTS 5.2.x allows an attacker who already holds a valid administrator account to crash or destabilize the NAS and cause a denial-of-service condition. The flaw is network-reachable and requires no user interaction, but the administrative-credential prerequisite sharply limits exposure to insiders or attackers who have already compromised the admin layer; impact is availability-only. No public exploit code or CISA KEV entry was identified, EPSS is low at 0.14% (34th percentile), and QNAP has released fixed builds starting with QTS 5.2.6.3195 build 20250715; given the admin prerequisite and availability-only impact, this is a low-to-moderate priority item unlikely to warrant emergency patching.
QNAP QTS and QuTS hero contain a NULL pointer dereference that can be triggered by a remote attacker with an administrator account, resulting in a low-impact denial-of-service condition. Affected devices are QTS 5.2.x and QuTS hero h5.2.x before build 20250715, and the vendor has released QTS 5.2.6.3195 and QuTS hero h5.2.6.3195 (build 20250715). No public exploit code or confirmed active exploitation was identified in the provided intelligence, and EPSS is low at 0.14%.
Authenticated denial of service in QNAP QTS 5.2.x and QuTS hero h5.2.x: a remote attacker who already holds an administrator account on the NAS can trigger a NULL pointer dereference that disrupts service on the appliance. Exploitation requires the highest privilege level (CVSS PR:H) over the network against the management plane, and the resulting impact is limited to availability; there is no confidentiality or integrity loss. QNAP has released fixed builds (QTS 5.2.6.3195 build 20250715 and QuTS hero h5.2.6.3195 build 20250715), EPSS is low at roughly 0.14% (34th percentile), and no public exploit code or confirmed active exploitation was identified at time of analysis.
Authenticated administrators on QNAP QTS and QuTS hero can exploit externally controlled format strings to disclose secret data or corrupt memory, but only after obtaining an existing administrator account. QTS 5.2.x before 5.2.6.3195 build 20250715 and QuTS hero h5.2.x before h5.2.6.3195 build 20250715 are affected; patched builds are not exploitable. EPSS is low at 0.05% (16th percentile) and no public exploit identified at time of analysis.
Denial of service in QNAP QTS and QuTS hero 5.2.x requires an attacker to already hold a valid administrator account; once authenticated, a crafted request to the network-reachable management service can trigger a NULL pointer dereference and disrupt the service. QNAP has released fixed builds, no public exploit code has been identified at time of analysis, and EPSS is low at 0.14%, so this is a genuine but low-priority issue constrained by the high-privilege prerequisite.
Denial-of-service conditions can be triggered in QNAP QTS and QuTS hero 5.2.x through a NULL pointer dereference that requires the attacker to already hold a valid administrator account on the target NAS. The flaw is network-reachable and needs no user interaction, but the administrator-credential precondition and availability-only impact keep practical risk low; EPSS is 0.14% and no public exploit identified at time of analysis. Vendor-released fixed builds are QTS 5.2.6.3195 build 20250715 and QuTS hero h5.2.6.3195 build 20250715 and later.
NULL pointer dereference in QNAP QTS and QuTS hero 5.2.x allows an attacker who already holds a valid administrator account to crash an affected NAS service, producing a denial-of-service condition with low availability impact. The CVSS base score is 5.1, but the high authentication prerequisite sharply limits practical risk; no public exploit code or CISA KEV entry was identified at time of analysis, and EPSS is low at 0.14%. Affected systems are QTS and QuTS hero builds below 5.2.6.3195 build 20250715.
Authenticated administrators on QNAP QTS and QuTS hero 5.2.x systems can trigger a NULL pointer dereference that crashes or destabilizes the NAS, producing a denial-of-service condition. The flaw affects QTS versions below 5.2.6.3195 build 20250715 and QuTS hero h5.2.x below h5.2.6.3195 build 20250715; fixed builds are available from QNAP. No public exploit code or confirmed active exploitation was identified, and EPSS is low at 0.14%, so practical risk is largely limited to environments where administrator credentials have already been compromised or are held by a malicious insider.
Denial of service in QNAP QTS 5.2.x can be triggered by a remote attacker who already holds a valid administrator account, causing a NULL pointer dereference in a network-reachable component and a limited availability impact. The flaw affects QTS builds prior to 5.2.6.3195 build 20250715 and is fixed in that release; EPSS is very low at 0.14% (34th percentile), and the supplied data contains no KEV entry and no public exploit identified at time of analysis. Because administrator access already confers full device control, practical risk is low and is mainly an availability outage through misuse or lateral abuse of stolen administrator credentials.
A NULL pointer dereference in QNAP QTS 5.2.x and QuTS hero h5.2.x allows an attacker who already holds a valid administrator account on the NAS to crash or destabilize the device, producing a limited denial-of-service condition. The management interface must be network-reachable, but no user interaction is required; the decisive limiting factor is the high-privilege prerequisite, which confines realistic exploitation to compromised-credential, insider, or post-exploitation scenarios rather than unauthenticated remote attack. No public exploit code or active exploitation has been identified, and EPSS is low at 0.14% (34th percentile), making this a genuinely low-priority issue despite the MEDIUM CVSS 4.0 score of 5.1.
Command injection in QNAP QTS 5.2.x and QuTS hero h5.2.x lets a remote attacker who already holds a valid administrator account run arbitrary commands on the NAS, yielding limited confidentiality, integrity, and availability impact. The administrator privilege requirement (PR:H) is the main limiting factor: this is a post-authentication, privileged-user flaw, not something an unauthenticated or low-privileged attacker can trigger. QNAP has released fixed builds (QTS 5.2.6.3195 build 20250715 and QuTS hero h5.2.6.3195 build 20250715); EPSS is low (0.13%, 32nd percentile) and there is no public exploit or KEV listing, making this a medium-severity, lower-priority issue rather than an urgent threat.
QNAP QTS and QuTS hero contain a path traversal flaw that lets an attacker who already holds an administrator account read files and system data outside the intended directory, with confidentiality-only impact and no write or denial-of-service effect. The issue affects QTS 5.2.x before 5.2.6.3195 build 20250715 and QuTS hero h5.2.x before h5.2.6.3195 build 20250715; vendor-released fixed builds are available. EPSS is low at 0.06% (17th percentile), no public exploit identified at time of analysis, and the administrator privilege prerequisite (PR:H) substantially limits real-world risk.
A path traversal vulnerability has been reported to affect several QNAP operating system versions. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An out-of-bounds write vulnerability has been reported to affect several QNAP operating system versions. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A path traversal vulnerability has been reported to affect several QNAP operating system versions. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A path traversal vulnerability has been reported to affect several QNAP operating system versions. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. Rated low severity (CVSS 2.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A command injection vulnerability has been reported to affect several QNAP operating system versions. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Command injection vulnerability affecting QNAP NAS operating systems (QTS and QuTS hero) that allows authenticated remote attackers to execute arbitrary commands with high severity (CVSS 8.8). The vulnerability requires valid user credentials but no user interaction, making it exploitable by compromised accounts or insider threats. QNAP has released patches as of March 21, 2025, and exploitation details are limited in public disclosures at this time.
A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained user access to modify memory or crash processes. We have already fixed the vulnerability in the following versions: QTS 5.2.4.3079 build 20250321 and later QuTS hero h5.2.4.3079 build 20250321 and later
An out-of-bounds write vulnerability has been reported to affect several QNAP operating system versions. Rated low severity (CVSS 2.1), this vulnerability is remotely exploitable. No vendor patch available.