Description
A command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained user access to execute arbitrary commands.
We have already fixed the vulnerability in the following versions:
QTS 5.2.4.3079 build 20250321 and later
QuTS hero h5.2.4.3079 build 20250321 and later
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| QNAP Systems | QTS | 5.2.x – < 5.2.4.3079 build 20250321 | 5.2.4.3079 build 20250321 |
| QNAP Systems | QuTS hero | h5.2.x – < h5.2.4.3079 build 20250321 | h5.2.4.3079 build 20250321 |
Advisories 1
- WID-SEC-2025-1272 QNAP NAS Software und Anwendungen: Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 30, 2026