QNAP QTS and QuTS Hero NULL Pointer Dereference Vulnerability Leading to Denial-of-Service

A NULL pointer dereference vulnerability has been identified in multiple QNAP operating system versions, specifically QTS 5.2.x and QuTS hero h5.2.x. This vulnerability allows remote attackers to launch a denial-of-service (DoS) attack by exploiting the NULL pointer dereference, causing affected systems to become unresponsive or unavailable.

Impact

Exploitation of this vulnerability leads to a denial-of-service condition, causing the system to become unresponsive or unavailable.

Remediation

Users can update to QTS 5.2.5.3145 build 20250526 or QuTS hero h5.2.5.3138 build 20250519. To update, log in as an administrator, go to the Control Panel, then System, and select Firmware Update. Under Live Update, click Check for Update. Alternatively, download the update from the QNAP Download Center.