QNAP QTS and QuTS hero Externally-Controlled Format String Vulnerability

A use of externally-controlled format string vulnerability has been reported in QNAP QTS versions 5.2.x and QuTS hero versions h5.2.x and h5.3.x. This vulnerability allows remote attackers with administrator access to exploit the issue, potentially leading to the disclosure of secret data or unauthorized memory modification.

Impact

Exploitation of this vulnerability could result in the unauthorized disclosure of sensitive information or unintended modifications to memory, which could be leveraged for further attacks.

Remediation

Users can update to QTS 5.2.7.3256 build 20250913 or later, or QuTS hero h5.2.7.3256 build 20250913 and later. For QuTS hero h5.3.x, update to QuTS hero h5.3.1.3250 build 20250912 and later.