QNAP QTS and QuTS Hero Command Injection Vulnerability

A command injection vulnerability exists in QNAP QTS 5.2.x and QuTS hero h5.2.x. If a remote attacker gains administrative access, they can exploit this vulnerability to execute arbitrary commands on the system.

Impact

Exploitation allows for arbitrary command execution on the affected system.

Remediation

Users can update to QTS 5.2.6.3195 build 20250715 or later, or QuTS hero h5.2.6.3195 build 20250715 or later. Instructions for updating are available on the QNAP website.