QNAP Authentication Bypass Vulnerability Allowing Unauthorized Access to Resources

A vulnerability allowing authentication bypass through spoofing has been identified in multiple QNAP operating system versions. This issue enables remote attackers to access resources that would typically require proper authentication. The vulnerability has been addressed in QTS 5.2.7.3297 build 20251024 and later, as well as in QuTS hero h5.2.7.3297 build 20251024 and QuTS hero h5.3.1.3292 build 20251024.

Impact

Exploitation of this vulnerability allows unauthorized access to resources, bypassing normal authentication requirements.

Remediation

Users can upgrade to QTS 5.2.7.3297 build 20251024 or later, or to QuTS hero h5.2.7.3297 build 20251024 or h5.3.1.3292 build 20251024.