QNAP QTS and QuTS hero Resource Allocation Vulnerability

A vulnerability allowing unlimited resource allocation has been identified in QNAP QTS and QuTS hero operating systems. This issue affects several versions within the QTS 5.2.x and QuTS hero h5.2.x, h5.3.x series. If a remote attacker gains access to a user account, they can exploit this vulnerability to monopolize resources, preventing other systems, applications, or processes from accessing the same type of resource.

Impact

Exploitation of this vulnerability can lead to resource exhaustion, causing disruptions in system performance by blocking other applications or processes from accessing essential resources.

Remediation

QNAP has released patches for this vulnerability. Users can update to QTS 5.2.7.3256 build 20250913 or later, or to QuTS hero h5.3.1.3250 build 20250912 or later. Instructions for updating QTS or QuTS hero are available on the QNAP website.