CVE-2025-53593

QTS, QuTS hero

A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following versions: QTS 5.2.7.3256 build 20250913 and later QuTS hero h5.2.7.3256 build 20250913 and later QuTS hero h5.3.1.3250 build 20250912 and later

CVSS 4.0 · 1.2 Low EPSS < 1% KEV · Not listed

Vendors

Qnap Qnap Systems Inc.

Products

Qts Quts Hero Qts and 1 more

CVE-2025-53596

QTS, QuTS hero

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QTS 5.2.7.3256 build 20250913 and later QuTS hero h5.2.7.3256 build 20250913 and later QuTS hero h5.3.1.3250 build 20250912 and later

CVSS 4.0 · 1.2 Low EPSS < 1% KEV · Not listed

Vendors

Qnap Qnap Systems Inc.

Products

Qts Quts Hero Qts and 1 more

CVE-2025-44013

QTS, QuTS hero

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QTS 5.2.6.3195 build 20250715 and later QuTS hero h5.2.6.3195 build 20250715 and later

CVSS 4.0 · 1.3 Low EPSS < 1% KEV · Not listed

Vendors

Qnap Qnap Systems Inc.

Products

Qts Quts Hero Qts and 1 more

CVE-2025-52426

QTS, QuTS hero

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QTS 5.2.7.3256 build 20250913 and later QuTS hero h5.2.7.3256 build 20250913 and later QuTS hero h5.3.1.3250 build 20250912 and later

CVSS 4.0 · 1.2 Low EPSS < 1% KEV · Not listed

Vendors

Qnap Qnap Systems Inc.

Products

Qts Quts Hero Qts and 1 more

CVE-2025-52430

QTS, QuTS hero

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QTS 5.2.7.3256 build 20250913 and later QuTS hero h5.2.7.3256 build 20250913 and later QuTS hero h5.3.1.3250 build 20250912 and later

CVSS 4.0 · 1.2 Low EPSS < 1% KEV · Not listed

Vendors

Qnap Qnap Systems Inc.

Products

Qts Quts Hero Qts and 1 more

CVE-2025-52431

QTS, QuTS hero

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QTS 5.2.7.3256 build 20250913 and later QuTS hero h5.2.7.3256 build 20250913 and later QuTS hero h5.3.1.3250 build 20250912 and later

CVSS 4.0 · 1.2 Low EPSS < 1% KEV · Not listed

Vendors

Qnap Qnap Systems Inc.

Products

Qts Quts Hero Qts and 1 more

CVE-2025-53405

QTS, QuTS hero

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QTS 5.2.7.3256 build 20250913 and later QuTS hero h5.2.7.3256 build 20250913 and later QuTS hero h5.3.1.3250 build 20250912 and later

CVSS 4.0 · 1.2 Low EPSS < 1% KEV · Not listed

Vendors

Qnap Qnap Systems Inc.

Products

Qts Quts Hero Qts and 1 more

CVE-2025-53414

QTS, QuTS hero

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QTS 5.2.7.3256 build 20250913 and later QuTS hero h5.2.7.3256 build 20250913 and later QuTS hero h5.3.1.3250 build 20250912 and later

CVSS 4.0 · 1.2 Low EPSS < 1% KEV · Not listed

Vendors

Qnap Qnap Systems Inc.

Products

Qts Quts Hero Qts and 1 more

CVE-2025-52863

QTS, QuTS hero

A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following versions: QTS 5.2.7.3256 build 20250913 and later QuTS hero h5.2.7.3256 build 20250913 and later QuTS hero h5.3.0.3192 build 20250716 and later

CVSS 4.0 · 1.3 Low EPSS < 1% KEV · Not listed

Vendors

Qnap Qnap Systems Inc.

Products

Qts Quts Hero Qts and 1 more

CVE-2025-52864

QTS, QuTS hero

A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following versions: QTS 5.2.7.3256 build 20250913 and later QuTS hero h5.2.7.3256 build 20250913 and later QuTS hero h5.3.0.3192 build 20250716 and later

CVSS 4.0 · 1.3 Low EPSS < 1% KEV · Not listed

Vendors

Qnap Qnap Systems Inc.

Products

Qts Quts Hero Qts and 1 more

CVE-2025-52872

QTS, QuTS hero

A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following versions: QTS 5.2.7.3256 build 20250913 and later QuTS hero h5.2.7.3256 build 20250913 and later QuTS hero h5.3.0.3192 build 20250716 and later

CVSS 4.0 · 1.3 Low EPSS < 1% KEV · Not listed

Vendors

Qnap Qnap Systems Inc.

Products

Qts Quts Hero Qts and 1 more

CVE-2025-54164

QTS, QuTS hero

An out-of-bounds read vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret data. We have already fixed the vulnerability in the following versions: QTS 5.2.7.3256 build 20250913 and later QuTS hero h5.2.7.3256 build 20250913 and later QuTS hero h5.3.1.3250 build 20250912 and later

CVSS 4.0 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Qnap Qnap Systems Inc.

Products

Qts Quts Hero Qts and 1 more

CVE-2025-54165

QTS, QuTS hero

An out-of-bounds read vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret data. We have already fixed the vulnerability in the following versions: QTS 5.2.7.3256 build 20250913 and later QuTS hero h5.2.7.3256 build 20250913 and later QuTS hero h5.3.1.3250 build 20250912 and later

CVSS 4.0 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Qnap Qnap Systems Inc.

Products

Qts Quts Hero Qts and 1 more

CVE-2025-54166

QTS, QuTS hero

An out-of-bounds read vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret data. We have already fixed the vulnerability in the following versions: QTS 5.2.7.3256 build 20250913 and later QuTS hero h5.2.7.3256 build 20250913 and later QuTS hero h5.3.1.3250 build 20250912 and later

CVSS 4.0 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Qnap Qnap Systems Inc.

Products

Qts Quts Hero Qts and 1 more

CVE-2025-47208

QTS, QuTS hero

An allocation of resources without limits or throttling vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource. We have already fixed the vulnerability in the following versions: QTS 5.2.6.3195 build 20250715 and later QuTS hero h5.2.6.3195 build 20250715 and later

CVSS 4.0 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Qnap Qnap Systems Inc.

Products

Qts Quts Hero Qts and 1 more

CVE-2025-57705

QTS, QuTS hero

An allocation of resources without limits or throttling vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource. We have already fixed the vulnerability in the following versions: QTS 5.2.7.3256 build 20250913 and later QuTS hero h5.2.7.3256 build 20250913 and later QuTS hero h5.3.1.3250 build 20250912 and later

CVSS 4.0 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Qnap Qnap Systems Inc.

Products

Qts Quts Hero Qts and 1 more

CVE-2024-21900

QTS, QuTS hero, QuTScloud

An injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.3.2578 build 20231110 and later QuTS hero h5.1.3.2578 build 20231110 and later QuTScloud c5.1.5.2651 and later

CVSS 3.1 · 4.3 Medium EPSS 9.4% KEV · Not listed

Vendors

Qnap

Products

Qts Quts Hero Qutscloud

CVE-2023-47218

QTS, QuTS hero, QuTScloud

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.5.2645 build 20240116 and later QuTS hero h5.1.5.2647 build 20240118 and later QuTScloud c5.1.5.2651 and later

CVSS 3.1 · 5.8 Medium EPSS 89.9% KEV · Not listed

Vendors

Qnap

Products

Qts Quts Hero Qutscloud

CVE-2023-34980

QTS, QuTS hero

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 4.5.4.2627 build 20231225 and later QuTS hero h4.5.4.2626 build 20231225 and later

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Qnap

Products

Qts Quts Hero

CVE-2023-51364

QTS, QuTS hero, QuTScloud

A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to read the contents of unexpected files and expose sensitive data via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.4.2596 build 20231128 and later QTS 4.5.4.2627 build 20231225 and later QuTS hero h5.1.3.2578 build 20231110 and later QuTS hero h4.5.4.2626 build 20231225 and later QuTScloud c5.1.5.2651 and later

CVSS 3.1 · 8.7 High EPSS 39.7% KEV · Not listed

Vendors

Qnap

Products

Qts Quts Hero Qutscloud