QNAP QTS / QuTS hero vulnerabilities

An allocation of resources without limits or throttling vulnerability in QNAP operating systems can be exploited by a remote attacker who gains an administrator account to prevent other systems, applications, or processes from accessing the same type of resource. The vendor has fixed the vulnerability in QTS 5.2.7.3256 build 20250913 and later, and QuTS hero h5.2.7.3256 build 20250913 and h5.3.1.3250 build 20250912 and later.

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can exploit the vulnerability to launch a denial-of-service (DoS) attack.

A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can exploit the vulnerability to modify memory or crash processes.

A NULL pointer dereference vulnerability affects several QNAP operating system versions. A remote attacker who gains a user account can exploit it to launch a denial-of-service (DoS) attack.

A use of externally-controlled format string vulnerability affects several QNAP operating system versions. A remote attacker who gains an administrator account can exploit it to obtain secret data or modify memory.

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can exploit the vulnerability to launch a denial-of-service (DoS) attack.

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can exploit the vulnerability to launch a denial-of-service (DoS) attack.

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can exploit the vulnerability to launch a denial-of-service (DoS) attack.

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can exploit the vulnerability to launch a denial-of-service (DoS) attack.

An allocation of resources without limits or throttling vulnerability affects several QNAP operating system versions. A remote attacker who gains a user account can exploit it to prevent other systems, applications, or processes from accessing the same type of resource.

A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. A remote attacker who gains an administrator account can exploit the vulnerability to obtain secret data or modify memory. The vulnerability has been fixed in QTS 5.2.6.3195 build 20250715 and later and QuTS hero h5.2.6.3195 build 20250715 and later.

A use of externally-controlled format string vulnerability has been reported in several QNAP operating system versions. If a remote attacker gains an administrator account, they can exploit it to obtain secret data or modify memory.

A NULL pointer dereference vulnerability affects several QNAP operating system versions. If a remote attacker gains an administrator account, they can exploit it to launch a denial-of-service (DoS) attack. The issue is fixed in QTS 5.2.6.3195 build 20250715 and later and QuTS hero h5.2.6.3195 build 20250715 and later.

A NULL pointer dereference vulnerability affects several QNAP operating system versions. If a remote attacker gains an administrator account, they can exploit it to launch a denial-of-service (DoS) attack. The issue is fixed in QTS 5.2.6.3195 build 20250715 and later and QuTS hero h5.2.6.3195 build 20250715 and later.

A NULL pointer dereference vulnerability affects several QNAP operating system versions. If a remote attacker gains an administrator account, they can exploit it to launch a denial-of-service (DoS) attack. The issue is fixed in QTS 5.2.6.3195 build 20250715 and later and QuTS hero h5.2.6.3195 build 20250715 and later.

A NULL pointer dereference vulnerability affects several QNAP operating system versions. If a remote attacker gains an administrator account, they can exploit it to launch a denial-of-service (DoS) attack. The issue is fixed in QTS 5.2.6.3195 build 20250715 and later and QuTS hero h5.2.6.3195 build 20250715 and later.

A NULL pointer dereference vulnerability affects several QNAP operating system versions. If a remote attacker gains an administrator account, they can exploit it to launch a denial-of-service (DoS) attack. The issue is fixed in QTS 5.2.6.3195 build 20250715 and later and QuTS hero h5.2.6.3195 build 20250715 and later.

A NULL pointer dereference vulnerability affects several QNAP operating system versions. If a remote attacker gains an administrator account, they can exploit it to launch a denial-of-service (DoS) attack. The issue is fixed in QTS 5.2.6.3195 build 20250715 and later and QuTS hero h5.2.6.3195 build 20250715 and later.

A NULL pointer dereference vulnerability affects several QNAP operating system versions. If a remote attacker gains an administrator account, they can exploit it to launch a denial-of-service (DoS) attack. The issue is fixed in QTS 5.2.6.3195 build 20250715 and later and QuTS hero h5.2.6.3195 build 20250715 and later.

A NULL pointer dereference vulnerability affects several QNAP operating system versions. If a remote attacker gains an administrator account, they can exploit it to launch a denial-of-service (DoS) attack. The issue is fixed in QTS 5.2.6.3195 build 20250715 and later and QuTS hero h5.2.6.3195 build 20250715 and later.

A NULL pointer dereference vulnerability affects several QNAP operating system versions. If a remote attacker gains an administrator account, they can exploit it to launch a denial-of-service (DoS) attack. The issue is fixed in QTS 5.2.6.3195 build 20250715 and later, QuTS hero h5.2.6.3195 build 20250715 and later, and QuTS hero h5.3.0.3192 build 20250716 and later.

A use of externally-controlled format string vulnerability has been reported in several QNAP operating system versions. If a remote attacker gains an administrator account, they can exploit it to obtain secret data or modify memory.

A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. A remote attacker with an administrator account can exploit it to obtain secret data or modify memory.

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. A remote attacker who gains an administrator account can exploit it to launch a denial-of-service (DoS) attack.

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. A remote attacker who gains an administrator account can exploit it to launch a denial-of-service (DoS) attack.

A command injection vulnerability in several QNAP operating system versions could be exploited by a remote attacker who gains an administrator account to execute arbitrary commands. The vulnerability has been fixed in QTS 5.2.6.3195 build 20250715 and later, and QuTS hero h5.2.6.3195 build 20250715 and later.

A path traversal vulnerability has been reported in several QNAP operating system versions. If a remote attacker gains an administrator account, they can exploit the vulnerability to read unexpected files or system data.

A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data.

An out-of-bounds write vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to modify or corrupt memory.

A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.

A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.

A command injection vulnerability has been reported to affect several QNAP operating system versions. A remote attacker who gains a user account can exploit the vulnerability to execute arbitrary commands.