PT-2025-46145 · Qnap · Qts+1

Le Mau Anh Phong · Published 2025-11-08 · Updated 2026-03-16 · CVE-2025-62849

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions QNAP QTS versions prior to 5.2.7.3297 build 20251024 QNAP QuTS hero versions prior to h5.2.7.3297 build 20251024 QNAP QuTS hero versions prior to h5.3.1.3292 build 20251024

Description An SQL injection flaw exists in QNAP NAS devices running QTS and QuTS hero operating systems. Successful exploitation of this issue could allow a remote attacker to execute unauthorized code and potentially compromise the device. The vulnerability allows attackers to execute unauthorized code or commands.

Recommendations Update QTS to version 5.2.7.3297 build 20251024 or later. Update QuTS hero to version h5.2.7.3297 build 20251024 or later. Update QuTS hero to version h5.3.1.3292 build 20251024 or later.

Fix

RCE

Use After Free

SQL injection

Weakness Enumeration

CWE-416

CWE-89

Related Identifiers

BDU:2025-16028

CVE-2025-62849

ZDI-26-200

Affected Products

Qts

Quts Hero

References · 13

• https://bdu.fstec.ru/vul/2025-16028 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-26-200 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-62849 · Security Note
• https://qnap.com/en/security-advisory/qsa-25-45 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-62849 · Vendor Advisory
• https://twitter.com/CVEnew/status/2002835995616485817 · Twitter Post
• https://t.me/cveNotify/146079 · Telegram Post
• https://t.me/true_secator/7607 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2000807220439548173 · Twitter Post
• https://securityonline.info/critical-warning-qnap-patches-seven-zero-days-exploited-at-pwn2own-2025 · Note
• https://twitter.com/wazuh/status/2003418727123988728 · Twitter Post
• https://t.me/CVEtracker/39916 · Telegram Post
• https://cybersecuritynews.com/qnap-zero-day-vulnerabilities-exploited · Note