QNAP QTS and QuTS Hero NULL Pointer Dereference Vulnerability Leading to Denial-of-Service

A NULL pointer dereference vulnerability has been identified in multiple versions of QNAP's operating systems, specifically QTS 5.2.x and QuTS hero h5.2.x. This vulnerability allows remote attackers with user account access to cause a denial-of-service (DoS) condition by exploiting the NULL pointer dereference, potentially leading to application crashes or unresponsive services.

Impact

Exploitation of this vulnerability causes a denial-of-service (DoS) condition, where the application or service becomes unresponsive or unavailable.

Remediation

Users can update to QTS 5.2.5.3145 build 20250526 or later, and QuTS hero h5.2.5.3138 build 20250519 or later. Instructions for updating QTS or QuTS hero are available on the QNAP website.