QNAP QTS and QuTS hero NULL Pointer Dereference Vulnerability Leading to Denial-of-Service

A NULL pointer dereference vulnerability has been identified in QNAP QTS and QuTS hero operating systems. This vulnerability affects several different versions and stems from an issue that allows remote attackers with administrator access to cause a denial-of-service (DoS) condition by exploiting the NULL pointer dereference.

Impact

Exploitation of this vulnerability leads to a denial-of-service condition, causing affected systems to become unresponsive or unavailable.

Remediation

QNAP has released patches for this vulnerability. Users can update to QTS 5.2.7.3256 build 20250913 and later, or QuTS hero h5.2.7.3256 build 20250913 and later. For QuTS hero h5.3.x, the latest version is h5.3.1.3250 build 20250912. Instructions for updating QTS or QuTS hero are available on the QNAP website.