PT-2026-48358 · Qnap · Quts Hero

Coral · CVE-2025-62850 · Published 2026-06-10 · Updated 2026-06-10

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions QuTS hero versions prior to h5.2.9.3410 build 20260214 QuTS hero versions prior to h5.3.4.3500 build 20260520 QuTS hero versions prior to h6.0.0.3459 build 20260409

Description A NULL pointer dereference occurs when a program attempts to read or write to a memory address that is NULL, typically leading to a system crash. A remote attacker with administrator account privileges can exploit this issue to launch a denial-of-service (DoS) attack, which renders the system unavailable to users.

Recommendations Update to version h5.2.9.3410 build 20260214 or later. Update to version h5.3.4.3500 build 20260520 or later. Update to version h6.0.0.3459 build 20260409 or later.

Fix

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2025-62850

Affected Products

Quts Hero

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-62850 · Security Note
• https://twitter.com/VulmonFeeds/status/2064615443810173397 · Twitter Post
• https://t.me/cveNotify/166775 · Telegram Post
• https://t.me/CVEtracker/56400 · Telegram Post
• https://qnap.com/en/security-advisory/qsa-26-38 · Note