QNAP QTS and QuTS hero Externally-Controlled Format String Vulnerability

A use of externally-controlled format string vulnerability has been reported in QNAP QTS versions 5.2.x and QuTS hero h5.2.x. If a remote attacker gains access to an administrator account, they can exploit this vulnerability to obtain secret data or modify memory. The vulnerability has been fixed in QTS 5.2.6.3195 build 20250715 and later, as well as in QuTS hero h5.2.6.3195 build 20250715 and later.

Impact

Exploitation of this vulnerability could lead to unauthorized access to secret data or unauthorized memory modification.

Remediation

Users are advised to update to QTS 5.2.6.3195 build 20250715 or later, or to QuTS hero h5.2.6.3195 build 20250715 or later. Instructions for updating QTS or QuTS hero are available on the QNAP website.