QNAP QTS and QuTS hero NULL Pointer Dereference Vulnerability Leading to Denial-of-Service

A NULL pointer dereference vulnerability has been identified in QNAP QTS 5.2.x and QuTS hero h5.2.x. This vulnerability allows remote attackers with administrator access to cause a denial-of-service (DoS) condition by exploiting the NULL pointer dereference.

Impact

Exploitation of this vulnerability leads to a denial-of-service condition, causing the system to become unresponsive or unavailable.

Remediation

QNAP has fixed this vulnerability in QTS 5.2.6.3195 build 20250715 and later, as well as in QuTS hero h5.2.6.3195 build 20250715 and later. Users are advised to update their systems to the latest version. Instructions for updating QTS or QuTS hero are available on the QNAP website.