ZDI-26-200
HIGH 8.0
Published
Mar 16, 2026
QNAP TS-453E nvrlog_event_add msg SQL Injection Remote Code Execution Vulnerability
QNAP
A high-severity remote code execution vulnerability (CVE-2025-62849) affects QNAP TS-453E network-attached storage devices, allowing network-adjacent attackers to execute arbitrary code by bypassing the required authentication mechanism. This gives attackers complete control over the affected device and any data stored on it. Security teams should immediately prioritize patching QNAP TS-453E devices and restrict network access to these systems until updates are available.