CVE-2025-53407
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. A remote attacker who gains an administrator account can exploit the vulnerability to obtain secret data or modify memory. The vulnerability has been fixed in QTS 5.2.6.3195 build 20250715 and later and QuTS hero h5.2.6.3195 build 20250715 and later.
Risk Assessment
An attacker with administrator privileges could access secret data or corrupt memory, potentially leading to further system compromise. However, it requires an administrator account.
Recommendation
Update QTS to version 5.2.6.3195 build 20250715 or later (or QuTS hero h5.2.6.3195 build 20250715 or later) and limit administrator accounts to those necessary.
Other vulnerabilities in QNAP QTS / QuTS hero
See all- CVE-2020-2509CriticalActively exploited
A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application.
- CVE-2025-57705Medium
An allocation of resources without limits or throttling vulnerability in QNAP operating systems can be exploited by a remote attacker who gains an administrator account to prevent other systems, applications, or processes from accessing the same type of resource. The vendor has fixed the vulnerability in QTS 5.2.7.3256 build 20250913 and later, and QuTS hero h5.2.7.3256 build 20250913 and h5.3.1.3250 build 20250912 and later.
- CVE-2025-53596Medium
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can exploit the vulnerability to launch a denial-of-service (DoS) attack.
- CVE-2025-53593Medium
A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can exploit the vulnerability to modify memory or crash processes.
- CVE-2025-53592Medium
A NULL pointer dereference vulnerability affects several QNAP operating system versions. A remote attacker who gains a user account can exploit it to launch a denial-of-service (DoS) attack.
- CVE-2025-53591Medium
A use of externally-controlled format string vulnerability affects several QNAP operating system versions. A remote attacker who gains an administrator account can exploit it to obtain secret data or modify memory.
- CVE-2025-53589Medium
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can exploit the vulnerability to launch a denial-of-service (DoS) attack.
- CVE-2025-53414Medium
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can exploit the vulnerability to launch a denial-of-service (DoS) attack.
- CVE-2025-53405Medium
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can exploit the vulnerability to launch a denial-of-service (DoS) attack.
- CVE-2025-52431Medium
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can exploit the vulnerability to launch a denial-of-service (DoS) attack.
Original NVD description (English source)
A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret data or modify memory. We have already fixed the vulnerability in the following versions: QTS 5.2.6.3195 build 20250715 and later QuTS hero h5.2.6.3195 build 20250715 and later
Vulnerability data from NVD (NIST) · CISA KEV · EPSS