Read the docs
TI-2025-32894 Aliases CVE-2025-52857GHSA-x97m-5mrr-hp8p

NULL pointer dereference in QNAP QTS

Priority LOW 23CWE-476Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-476.

Summary

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QTS 5.2.6.3195 build 20250715 and later QuTS hero h5.2.6.3195 build 20250715 and later

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00382 32nd percentileScored 2026-11-07
Fix Fixed QTS (QNAP Systems Inc.): 5.2.6.3195 build 20250715QuTS hero (QNAP Systems Inc.): h5.2.6.3195 build 20250715

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
QNAPQTS5.2.x to before 5.2.6.3195 build 202507155.2.6.3195 build 20250715Patch availableCNA
QNAPQuTS heroh5.2.x to before h5.2.6.3195 build 20250715h5.2.6.3195 build 20250715Patch availableCNA
  • QTS VendorQNAP Affected 5.2.x to before 5.2.6.3195 build 20250715 Fixed in 5.2.6.3195 build 20250715 Patch available CNA
  • QuTS hero VendorQNAP Affected h5.2.x to before h5.2.6.3195 build 20250715 Fixed in h5.2.6.3195 build 20250715 Patch available CNA

CPE configurations NVD · 28

CPEVersionsRoleVendor
cpe:2.3:o:qnap:qts:5.2.0.2737:build_20240417:*:*:*:*:*:*5.2.0.2737 build_20240417VulnerableQNAP
cpe:2.3:o:qnap:qts:5.2.0.2744:build_20240424:*:*:*:*:*:*5.2.0.2744 build_20240424VulnerableQNAP
cpe:2.3:o:qnap:qts:5.2.0.2782:build_20240601:*:*:*:*:*:*5.2.0.2782 build_20240601VulnerableQNAP
cpe:2.3:o:qnap:qts:5.2.0.2802:build_20240620:*:*:*:*:*:*5.2.0.2802 build_20240620VulnerableQNAP
cpe:2.3:o:qnap:qts:5.2.0.2823:build_20240711:*:*:*:*:*:*5.2.0.2823 build_20240711VulnerableQNAP
cpe:2.3:o:qnap:qts:5.2.0.2851:build_20240808:*:*:*:*:*:*5.2.0.2851 build_20240808VulnerableQNAP
cpe:2.3:o:qnap:qts:5.2.0.2860:build_20240817:*:*:*:*:*:*5.2.0.2860 build_20240817VulnerableQNAP
cpe:2.3:o:qnap:qts:5.2.1.2930:build_20241025:*:*:*:*:*:*5.2.1.2930 build_20241025VulnerableQNAP
cpe:2.3:o:qnap:qts:5.2.2.2950:build_20241114:*:*:*:*:*:*5.2.2.2950 build_20241114VulnerableQNAP
cpe:2.3:o:qnap:qts:5.2.3.3006:build_20250108:*:*:*:*:*:*5.2.3.3006 build_20250108VulnerableQNAP
  • cpe:2.3:o:qnap:qts:5.2.0.2737:build_20240417:*:*:*:*:*:* Versions 5.2.0.2737 build_20240417 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:5.2.0.2744:build_20240424:*:*:*:*:*:* Versions 5.2.0.2744 build_20240424 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:5.2.0.2782:build_20240601:*:*:*:*:*:* Versions 5.2.0.2782 build_20240601 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:5.2.0.2802:build_20240620:*:*:*:*:*:* Versions 5.2.0.2802 build_20240620 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:5.2.0.2823:build_20240711:*:*:*:*:*:* Versions 5.2.0.2823 build_20240711 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:5.2.0.2851:build_20240808:*:*:*:*:*:* Versions 5.2.0.2851 build_20240808 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:5.2.0.2860:build_20240817:*:*:*:*:*:* Versions 5.2.0.2860 build_20240817 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:5.2.1.2930:build_20241025:*:*:*:*:*:* Versions 5.2.1.2930 build_20241025 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:5.2.2.2950:build_20241114:*:*:*:*:*:* Versions 5.2.2.2950 build_20241114 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:5.2.3.3006:build_20250108:*:*:*:*:*:* Versions 5.2.3.3006 build_20250108 Vulnerable ·QNAP
Show 18 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:qnap:qts:5.2.4.3070:build_20250312:*:*:*:*:*:*5.2.4.3070 build_20250312VulnerableQNAP
cpe:2.3:o:qnap:qts:5.2.4.3079:build_20250321:*:*:*:*:*:*5.2.4.3079 build_20250321VulnerableQNAP
cpe:2.3:o:qnap:qts:5.2.4.3092:build_20250403:*:*:*:*:*:*5.2.4.3092 build_20250403VulnerableQNAP
cpe:2.3:o:qnap:qts:5.2.5.3145:build_20250526:*:*:*:*:*:*5.2.5.3145 build_20250526VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h5.2.0.2737:build_20240417:*:*:*:*:*:*h5.2.0.2737 build_20240417VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h5.2.0.2782:build_20240601:*:*:*:*:*:*h5.2.0.2782 build_20240601VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h5.2.0.2789:build_20240607:*:*:*:*:*:*h5.2.0.2789 build_20240607VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h5.2.0.2802:build_20240620:*:*:*:*:*:*h5.2.0.2802 build_20240620VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h5.2.0.2823:build_20240711:*:*:*:*:*:*h5.2.0.2823 build_20240711VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h5.2.0.2851:build_20240808:*:*:*:*:*:*h5.2.0.2851 build_20240808VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h5.2.0.2860:build_20240817:*:*:*:*:*:*h5.2.0.2860 build_20240817VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h5.2.1.2929:build_20241025:*:*:*:*:*:*h5.2.1.2929 build_20241025VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h5.2.1.2940:build_20241105:*:*:*:*:*:*h5.2.1.2940 build_20241105VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h5.2.2.2952:build_20241116:*:*:*:*:*:*h5.2.2.2952 build_20241116VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h5.2.3.3006:build_20250108:*:*:*:*:*:*h5.2.3.3006 build_20250108VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h5.2.4.3070:build_20250312:*:*:*:*:*:*h5.2.4.3070 build_20250312VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h5.2.4.3079:build_20250321:*:*:*:*:*:*h5.2.4.3079 build_20250321VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h5.2.5.3138:build_20250519:*:*:*:*:*:*h5.2.5.3138 build_20250519VulnerableQNAP
  • cpe:2.3:o:qnap:qts:5.2.4.3070:build_20250312:*:*:*:*:*:* Versions 5.2.4.3070 build_20250312 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:5.2.4.3079:build_20250321:*:*:*:*:*:* Versions 5.2.4.3079 build_20250321 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:5.2.4.3092:build_20250403:*:*:*:*:*:* Versions 5.2.4.3092 build_20250403 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:5.2.5.3145:build_20250526:*:*:*:*:*:* Versions 5.2.5.3145 build_20250526 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h5.2.0.2737:build_20240417:*:*:*:*:*:* Versions h5.2.0.2737 build_20240417 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h5.2.0.2782:build_20240601:*:*:*:*:*:* Versions h5.2.0.2782 build_20240601 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h5.2.0.2789:build_20240607:*:*:*:*:*:* Versions h5.2.0.2789 build_20240607 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h5.2.0.2802:build_20240620:*:*:*:*:*:* Versions h5.2.0.2802 build_20240620 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h5.2.0.2823:build_20240711:*:*:*:*:*:* Versions h5.2.0.2823 build_20240711 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h5.2.0.2851:build_20240808:*:*:*:*:*:* Versions h5.2.0.2851 build_20240808 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h5.2.0.2860:build_20240817:*:*:*:*:*:* Versions h5.2.0.2860 build_20240817 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h5.2.1.2929:build_20241025:*:*:*:*:*:* Versions h5.2.1.2929 build_20241025 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h5.2.1.2940:build_20241105:*:*:*:*:*:* Versions h5.2.1.2940 build_20241105 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h5.2.2.2952:build_20241116:*:*:*:*:*:* Versions h5.2.2.2952 build_20241116 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h5.2.3.3006:build_20250108:*:*:*:*:*:* Versions h5.2.3.3006 build_20250108 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h5.2.4.3070:build_20250312:*:*:*:*:*:* Versions h5.2.4.3070 build_20250312 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h5.2.4.3079:build_20250321:*:*:*:*:*:* Versions h5.2.4.3079 build_20250321 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h5.2.5.3138:build_20250519:*:*:*:*:*:* Versions h5.2.5.3138 build_20250519 Vulnerable ·QNAP

Remediation

  • Fix · CNA QTS (QNAP Systems Inc.) Fixed in 5.2.6.3195 build 20250715
  • Fix · CNA QuTS hero (QNAP Systems Inc.) Fixed in h5.2.6.3195 build 20250715

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    QNAP Systems QTS 5.2.6.3195 build 20250715

    26 records Highest priority Priority LOW 26 LOW

    Other records, highest priority first

    Show all 26 records →
  • Release ·

    QNAP Systems QuTS hero h5.2.6.3195 build 20250715

    23 records Highest priority Priority LOW 23 LOW

    Other records, highest priority first

    Show all 23 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-52857
  2. 2026-10-03 Alias added: GHSA-x97m-5mrr-hp8p

References

Advisory 1

  • TI-2020-02221 Command Injection Vulnerability in QTS and QuTS hero KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-05101 Improper input validation in QNAP NAS devices KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-14137 Improper input validation in QNAP QTS KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05975 GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed… KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05157 GNU Bash through 4.3 processes trailing strings after function definitions in the values… KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-14131 Cross-site scripting in QNAP QTS KEVCVSS 3.1HIGH 8.0
See all 282 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences