CVE-2025-62850
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
A NULL pointer dereference vulnerability has been reported to affect QTS, QVP, QuTS cloud, and QuTS hero. If a remote attacker gains an administrator account, they can exploit the vulnerability to launch a denial-of-service (DoS) attack.
Risk Assessment
An attacker with administrator privileges can cause the service to crash, making the system unavailable to users.
Recommendation
Update the software to a patched version: QTS 5.2.9.3410 build 20260214 or later, QVP 2.7.4 or later, QuTS cloud c5.2.9.3468 build 20260413 or later, QuTS hero h5.2.9.3410 build 20260214 or later, QuTS hero h5.3.4.3500 build 20260520 or later, QuTS hero h6.0.0.3459 build 20260409 or later.
Other vulnerabilities in QTS
See all- CVE-2025-66276Critical
The vulnerability affects QTS (QNAP operating system). The vendor confirms QuTS hero is not affected. The fix is included in QTS 5.2.7.3256 build 20250913 and later.
- CVE-2017-7876Critical
This command injection vulnerability in QTS allows attackers to run arbitrary commands in the compromised application.
Original NVD description (English source)
A NULL pointer dereference vulnerability has been reported to affect QTS, QVP, QuTS cloud and QuTS hero. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: QTS 5.2.9.3410 build 20260214 and later QVP 2.7.4 and later QuTS cloud c5.2.9.3468 build 20260413 and later QuTS hero h5.2.9.3410 build 20260214 and later QuTS hero h5.3.4.3500 build 20260520 and later QuTS hero h6.0.0.3459 build 20260409 and later
Vulnerability data from NVD (NIST) · CISA KEV · EPSS