NULL pointer dereference in QNAP QTS
Priority LOW 23CWE-476Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-476.
Summary
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QTS 5.2.5.3145 build 20250526 and later QuTS hero h5.2.5.3138 build 20250519 and later
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0031 23rd percentileScored 2026-11-07
Fix Fixed QTS (QNAP Systems Inc.): 5.2.5.3145 build 20250526QuTS hero (QNAP Systems Inc.): h5.2.5.3138 build 20250519
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| QNAP | QTS | 5.2.x to before 5.2.5.3145 build 20250526 | 5.2.5.3145 build 20250526 | Patch available | CNA |
| QNAP | QuTS hero | h5.2.x to before h5.2.5.3138 build 20250519 | h5.2.5.3138 build 20250519 | Patch available | CNA |
- QTS VendorQNAP Affected 5.2.x to before 5.2.5.3145 build 20250526 Fixed in 5.2.5.3145 build 20250526 Patch available CNA
- QuTS hero VendorQNAP Affected h5.2.x to before h5.2.5.3138 build 20250519 Fixed in h5.2.5.3138 build 20250519 Patch available CNA
CPE configurations NVD · 26
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:qnap:qts:5.2.0.2737:build_20240417:*:*:*:*:*:* | 5.2.0.2737 build_20240417 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:5.2.0.2744:build_20240424:*:*:*:*:*:* | 5.2.0.2744 build_20240424 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:5.2.0.2782:build_20240601:*:*:*:*:*:* | 5.2.0.2782 build_20240601 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:5.2.0.2802:build_20240620:*:*:*:*:*:* | 5.2.0.2802 build_20240620 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:5.2.0.2823:build_20240711:*:*:*:*:*:* | 5.2.0.2823 build_20240711 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:5.2.0.2851:build_20240808:*:*:*:*:*:* | 5.2.0.2851 build_20240808 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:5.2.0.2860:build_20240817:*:*:*:*:*:* | 5.2.0.2860 build_20240817 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:5.2.1.2930:build_20241025:*:*:*:*:*:* | 5.2.1.2930 build_20241025 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:5.2.2.2950:build_20241114:*:*:*:*:*:* | 5.2.2.2950 build_20241114 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:5.2.3.3006:build_20250108:*:*:*:*:*:* | 5.2.3.3006 build_20250108 | Vulnerable | QNAP |
- cpe:2.3:o:qnap:qts:5.2.0.2737:build_20240417:*:*:*:*:*:* Versions 5.2.0.2737 build_20240417 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:5.2.0.2744:build_20240424:*:*:*:*:*:* Versions 5.2.0.2744 build_20240424 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:5.2.0.2782:build_20240601:*:*:*:*:*:* Versions 5.2.0.2782 build_20240601 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:5.2.0.2802:build_20240620:*:*:*:*:*:* Versions 5.2.0.2802 build_20240620 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:5.2.0.2823:build_20240711:*:*:*:*:*:* Versions 5.2.0.2823 build_20240711 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:5.2.0.2851:build_20240808:*:*:*:*:*:* Versions 5.2.0.2851 build_20240808 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:5.2.0.2860:build_20240817:*:*:*:*:*:* Versions 5.2.0.2860 build_20240817 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:5.2.1.2930:build_20241025:*:*:*:*:*:* Versions 5.2.1.2930 build_20241025 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:5.2.2.2950:build_20241114:*:*:*:*:*:* Versions 5.2.2.2950 build_20241114 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:5.2.3.3006:build_20250108:*:*:*:*:*:* Versions 5.2.3.3006 build_20250108 Vulnerable ·QNAP
Show 16 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:qnap:qts:5.2.4.3070:build_20250312:*:*:*:*:*:* | 5.2.4.3070 build_20250312 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:5.2.4.3079:build_20250321:*:*:*:*:*:* | 5.2.4.3079 build_20250321 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:5.2.4.3092:build_20250403:*:*:*:*:*:* | 5.2.4.3092 build_20250403 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:quts_hero:h5.2.0.2737:build_20240417:*:*:*:*:*:* | h5.2.0.2737 build_20240417 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:quts_hero:h5.2.0.2782:build_20240601:*:*:*:*:*:* | h5.2.0.2782 build_20240601 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:quts_hero:h5.2.0.2789:build_20240607:*:*:*:*:*:* | h5.2.0.2789 build_20240607 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:quts_hero:h5.2.0.2802:build_20240620:*:*:*:*:*:* | h5.2.0.2802 build_20240620 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:quts_hero:h5.2.0.2823:build_20240711:*:*:*:*:*:* | h5.2.0.2823 build_20240711 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:quts_hero:h5.2.0.2851:build_20240808:*:*:*:*:*:* | h5.2.0.2851 build_20240808 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:quts_hero:h5.2.0.2860:build_20240817:*:*:*:*:*:* | h5.2.0.2860 build_20240817 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:quts_hero:h5.2.1.2929:build_20241025:*:*:*:*:*:* | h5.2.1.2929 build_20241025 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:quts_hero:h5.2.1.2940:build_20241105:*:*:*:*:*:* | h5.2.1.2940 build_20241105 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:quts_hero:h5.2.2.2952:build_20241116:*:*:*:*:*:* | h5.2.2.2952 build_20241116 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:quts_hero:h5.2.3.3006:build_20250108:*:*:*:*:*:* | h5.2.3.3006 build_20250108 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:quts_hero:h5.2.4.3070:build_20250312:*:*:*:*:*:* | h5.2.4.3070 build_20250312 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:quts_hero:h5.2.4.3079:build_20250321:*:*:*:*:*:* | h5.2.4.3079 build_20250321 | Vulnerable | QNAP |
- cpe:2.3:o:qnap:qts:5.2.4.3070:build_20250312:*:*:*:*:*:* Versions 5.2.4.3070 build_20250312 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:5.2.4.3079:build_20250321:*:*:*:*:*:* Versions 5.2.4.3079 build_20250321 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:5.2.4.3092:build_20250403:*:*:*:*:*:* Versions 5.2.4.3092 build_20250403 Vulnerable ·QNAP
- cpe:2.3:o:qnap:quts_hero:h5.2.0.2737:build_20240417:*:*:*:*:*:* Versions h5.2.0.2737 build_20240417 Vulnerable ·QNAP
- cpe:2.3:o:qnap:quts_hero:h5.2.0.2782:build_20240601:*:*:*:*:*:* Versions h5.2.0.2782 build_20240601 Vulnerable ·QNAP
- cpe:2.3:o:qnap:quts_hero:h5.2.0.2789:build_20240607:*:*:*:*:*:* Versions h5.2.0.2789 build_20240607 Vulnerable ·QNAP
- cpe:2.3:o:qnap:quts_hero:h5.2.0.2802:build_20240620:*:*:*:*:*:* Versions h5.2.0.2802 build_20240620 Vulnerable ·QNAP
- cpe:2.3:o:qnap:quts_hero:h5.2.0.2823:build_20240711:*:*:*:*:*:* Versions h5.2.0.2823 build_20240711 Vulnerable ·QNAP
- cpe:2.3:o:qnap:quts_hero:h5.2.0.2851:build_20240808:*:*:*:*:*:* Versions h5.2.0.2851 build_20240808 Vulnerable ·QNAP
- cpe:2.3:o:qnap:quts_hero:h5.2.0.2860:build_20240817:*:*:*:*:*:* Versions h5.2.0.2860 build_20240817 Vulnerable ·QNAP
- cpe:2.3:o:qnap:quts_hero:h5.2.1.2929:build_20241025:*:*:*:*:*:* Versions h5.2.1.2929 build_20241025 Vulnerable ·QNAP
- cpe:2.3:o:qnap:quts_hero:h5.2.1.2940:build_20241105:*:*:*:*:*:* Versions h5.2.1.2940 build_20241105 Vulnerable ·QNAP
- cpe:2.3:o:qnap:quts_hero:h5.2.2.2952:build_20241116:*:*:*:*:*:* Versions h5.2.2.2952 build_20241116 Vulnerable ·QNAP
- cpe:2.3:o:qnap:quts_hero:h5.2.3.3006:build_20250108:*:*:*:*:*:* Versions h5.2.3.3006 build_20250108 Vulnerable ·QNAP
- cpe:2.3:o:qnap:quts_hero:h5.2.4.3070:build_20250312:*:*:*:*:*:* Versions h5.2.4.3070 build_20250312 Vulnerable ·QNAP
- cpe:2.3:o:qnap:quts_hero:h5.2.4.3079:build_20250321:*:*:*:*:*:* Versions h5.2.4.3079 build_20250321 Vulnerable ·QNAP
Remediation
- Fix · CNA QTS (QNAP Systems Inc.) Fixed in 5.2.5.3145 build 20250526
- Fix · CNA QuTS hero (QNAP Systems Inc.) Fixed in h5.2.5.3138 build 20250519
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
QNAP Systems QTS 5.2.5.3145 build 20250526
11 records Highest priority Priority LOW 11 LOW
Other records, highest priority first
- TI-2025-21583 Command injection in QNAP QTSPriority LOW 39
- TI-2025-21592 Out-of-bounds write in QNAP QTSPriority LOW 31
- TI-2025-21590 Path traversal in QNAP QTSPriority LOW 25
- Release ·
QNAP Systems QuTS hero h5.2.5.3138 build 20250519
10 records Highest priority Priority LOW 10 LOW
Other records, highest priority first
- TI-2025-21583 Command injection in QNAP QTSPriority LOW 39
- TI-2025-21592 Out-of-bounds write in QNAP QTSPriority LOW 31
- TI-2025-21590 Path traversal in QNAP QTSPriority LOW 25
Timeline
- 2026-10-02 Threatist record created from CVE-2025-30274
- 2026-10-03 Alias added: GHSA-g3rj-xppw-7c7v
References
More QNAP Qts vulnerabilities
- TI-2020-02221 Command Injection Vulnerability in QTS and QuTS hero KEVCVSS 3.1CRITICAL 9.8
- TI-2019-05101 Improper input validation in QNAP NAS devices KEVCVSS 3.1CRITICAL 9.8
- TI-2018-14137 Improper input validation in QNAP QTS KEVCVSS 3.1CRITICAL 9.8
- TI-2014-05975 GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed… KEVCVSS 3.1CRITICAL 9.8
- TI-2014-05157 GNU Bash through 4.3 processes trailing strings after function definitions in the values… KEVCVSS 3.1CRITICAL 9.8
- TI-2018-14131 Cross-site scripting in QNAP QTS KEVCVSS 3.1HIGH 8.0
Sources
- CVE-2025-30274 · CVE Program
- CVE-2025-30274 · NVD
- FIRST EPSS
- GHSA-g3rj-xppw-7c7v · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences