QNAP QTS and QuTS hero Uninitialized Variable Vulnerability Leading to Denial-of-Service

A vulnerability allowing the use of uninitialized variables has been identified in QNAP's QTS and QuTS hero operating systems, specifically in versions 5.2.x. This vulnerability can be exploited by remote attackers who gain access to an administrator account, leading to denial-of-service conditions or unexpected modifications in control flow.

Impact

Exploitation of this vulnerability can cause denial-of-service conditions or allow for unexpected modifications in control flow.

Remediation

Users can update to QTS 5.2.8.3350 build 20251216 or QuTS hero h5.2.8.3350 build 20251216. Instructions for updating QTS or QuTS hero are available on the QNAP website.