QNAP QTS and QuTS Hero Command Injection Vulnerability

A command injection vulnerability exists in multiple QNAP operating system versions, including QTS 5.2.x and QuTS hero h5.2.x. This vulnerability allows remote attackers with user account access to execute arbitrary commands on the system.

Impact

Exploitation of this vulnerability could lead to unauthorized execution of commands, potentially allowing for further system compromise or disruption.

Remediation

Users can update to QTS 5.2.5.3145 build 20250526 or QuTS hero h5.2.5.3138 build 20250519. Instructions for updating QTS or QuTS hero are available on the QNAP website.