Volerion logoVolerion
Volerion logoVolerion

QNAP QTS and QuTS hero Command Injection Vulnerability

Vulnerability

A command injection vulnerability exists in multiple QNAP operating system versions, specifically QTS 5.2.x and QuTS hero h5.2.x. This vulnerability allows remote attackers with administrator access to execute arbitrary commands on the affected system.

Impact

Exploitation of this vulnerability could lead to unauthorized command execution on the affected system.

Remediation

Users can update to QTS 5.2.3.3006 build 20250108 or later, and QuTS hero h5.2.3.3006 build 20250108 or later. Instructions for updating QTS or QuTS hero are available on the QNAP website.

Added: Jun 9, 2025, 7:46 PM
Updated: Jun 9, 2025, 7:46 PM

Vulnerability Rating

Custom Algorithm
spread
6.8
impact
7.5
exploitability
4.4
remediation
7.7
relevance
0.0
threat
0.0
urgency
2.9
incentive
1.7

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.