CVE-2025-57705
MediumCVSS 4.9Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
An allocation of resources without limits or throttling vulnerability in QNAP operating systems can be exploited by a remote attacker who gains an administrator account to prevent other systems, applications, or processes from accessing the same type of resource. The vendor has fixed the vulnerability in QTS 5.2.7.3256 build 20250913 and later, and QuTS hero h5.2.7.3256 build 20250913 and h5.3.1.3250 build 20250912 and later.
Risk Assessment
An attacker with an administrator account could exhaust QNAP system resources, causing service unavailability for other systems and users.
Recommendation
Update the QNAP system to QTS 5.2.7.3256 build 20250913 or later, QuTS hero h5.2.7.3256 build 20250913 or h5.3.1.3250 build 20250912 or later.
Other vulnerabilities in QNAP QTS/QuTS hero
See all- CVE-2020-2509CriticalActively exploited
A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application.
- CVE-2025-53596Medium
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can exploit the vulnerability to launch a denial-of-service (DoS) attack.
- CVE-2025-53593Medium
A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can exploit the vulnerability to modify memory or crash processes.
- CVE-2025-53592Medium
A NULL pointer dereference vulnerability affects several QNAP operating system versions. A remote attacker who gains a user account can exploit it to launch a denial-of-service (DoS) attack.
- CVE-2025-53591Medium
A use of externally-controlled format string vulnerability affects several QNAP operating system versions. A remote attacker who gains an administrator account can exploit it to obtain secret data or modify memory.
- CVE-2025-53589Medium
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can exploit the vulnerability to launch a denial-of-service (DoS) attack.
- CVE-2025-53414Medium
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can exploit the vulnerability to launch a denial-of-service (DoS) attack.
- CVE-2025-53405Medium
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can exploit the vulnerability to launch a denial-of-service (DoS) attack.
- CVE-2025-52431Medium
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can exploit the vulnerability to launch a denial-of-service (DoS) attack.
- CVE-2025-47208Medium
An allocation of resources without limits or throttling vulnerability affects several QNAP operating system versions. A remote attacker who gains a user account can exploit it to prevent other systems, applications, or processes from accessing the same type of resource.
Original NVD description (English source)
An allocation of resources without limits or throttling vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource. We have already fixed the vulnerability in the following versions: QTS 5.2.7.3256 build 20250913 and later QuTS hero h5.2.7.3256 build 20250913 and later QuTS hero h5.3.1.3250 build 20250912 and later
Vulnerability data from NVD (NIST) · CISA KEV · EPSS