ZDI-26-200 HIGH 8.0 Published Mar 16, 2026

QNAP TS-453E nvrlog_event_add msg SQL Injection Remote Code Execution Vulnerability

QNAP

A high-severity remote code execution vulnerability (CVE-2025-62849) affects QNAP TS-453E network-attached storage devices, allowing network-adjacent attackers to execute arbitrary code by bypassing the required authentication mechanism. This gives attackers complete control over the affected device and any data stored on it. Security teams should immediately prioritize patching QNAP TS-453E devices and restrict network access to these systems until updates are available.

Related CVE

CVE-2025-62849

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy