Description
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to launch a denial-of-service (DoS) attack.
We have already fixed the vulnerability in the following versions:
QTS 5.2.7.3297 build 20251024 and later
QuTS hero h5.2.7.3297 build 20251024 and later
QuTS hero h5.3.1.3292 build 20251024 and later
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| QNAP Systems | QTS | 5.2.x – < 5.2.7.3297 build 20251024 | 5.2.7.3297 build 20251024 |
| QNAP Systems | QuTS hero | h5.2.x – < h5.2.7.3297 build 20251024, h5.3.x – < h5.3.1.3292 build 20251024 | h5.2.7.3297 build 20251024 |
Advisories 2
- NCSC-2025-0403 Kwetsbaarheden verholpen in QNAP besturingssystemen NCSC-NL (Netherlands) · Dec 29, 2025
- WID-SEC-2025-2529 QNAP NAS QTS und QTS hero: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff BSI CERT-Bund (WID) · Dec 15, 2025