Read the docs
TI-2025-40753 Aliases CVE-2025-66274GHSA-vf98-8xxx-fp8w

NULL pointer dereference in QNAP QTS

Priority LOW 24CWE-476Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-476.

Summary

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QTS 5.2.9.3410 build 20260214 and later QuTS hero h5.2.9.3410 build 20260214 and later QuTS hero h5.3.2.3354 build 20251225 and later QuTS hero h6.0.0.3397 build 20260206 and later

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00439 38th percentileScored 2026-11-07
Fix Fixed QTS (QNAP Systems Inc.): 5.2.9.3410 build 20260214QuTS hero (QNAP Systems Inc.): h5.2.9.3410 build 20260214, h5.3.2.3354 build 20251225, h6.0.0.3397 build 20260206

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
QNAPQTS5.2.0 to before 5.2.9.3410 build 202602145.2.9.3410 build 20260214Patch availableCNA
QNAPQuTS heroh5.2.0 to before h5.2.9.3410 build 20260214; h5.3.0 to before h5.3.2.3354 build 20251225; ? to before h6.0.0.3397 build 20260206h5.2.9.3410 build 20260214, h5.3.2.3354 build 20251225, h6.0.0.3397 build 20260206Patch availableCNA
  • QTS VendorQNAP Affected 5.2.0 to before 5.2.9.3410 build 20260214 Fixed in 5.2.9.3410 build 20260214 Patch available CNA
  • QuTS hero VendorQNAP Affected h5.2.0 to before h5.2.9.3410 build 20260214; h5.3.0 to before h5.3.2.3354 build 20251225; ? to before h6.0.0.3397 build 20260206 Fixed in h5.2.9.3410 build 20260214, h5.3.2.3354 build 20251225, h6.0.0.3397 build 20260206 Patch available CNA

CPE configurations NVD · 5

CPEVersionsRoleVendor
cpe:2.3:o:qnap:quts_hero:h5.3.0.3115:build_20250430:*:*:*:*:*:*h5.3.0.3115 build_20250430VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h5.3.0.3145:build_20250530:*:*:*:*:*:*h5.3.0.3145 build_20250530VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h5.3.0.3192:build_20250716:*:*:*:*:*:*h5.3.0.3192 build_20250716VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h5.3.1.3250:build_20250912:*:*:*:*:*:*h5.3.1.3250 build_20250912VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h5.3.1.3292:build_20251024:*:*:*:*:*:*h5.3.1.3292 build_20251024VulnerableQNAP
  • cpe:2.3:o:qnap:quts_hero:h5.3.0.3115:build_20250430:*:*:*:*:*:* Versions h5.3.0.3115 build_20250430 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h5.3.0.3145:build_20250530:*:*:*:*:*:* Versions h5.3.0.3145 build_20250530 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h5.3.0.3192:build_20250716:*:*:*:*:*:* Versions h5.3.0.3192 build_20250716 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h5.3.1.3250:build_20250912:*:*:*:*:*:* Versions h5.3.1.3250 build_20250912 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h5.3.1.3292:build_20251024:*:*:*:*:*:* Versions h5.3.1.3292 build_20251024 Vulnerable ·QNAP

Remediation

  • Fix · CNA QTS (QNAP Systems Inc.) Fixed in 5.2.9.3410 build 20260214
  • Fix · CNA QuTS hero (QNAP Systems Inc.) Fixed in h5.2.9.3410 build 20260214, h5.3.2.3354 build 20251225, h6.0.0.3397 build 20260206

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-66274
  2. 2026-10-03 Alias added: GHSA-vf98-8xxx-fp8w

References

Advisory 1

  • TI-2020-02221 Command Injection Vulnerability in QTS and QuTS hero KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-25536 Command injection in QNAP QTS CVSS 3.1HIGH 8.3
  • TI-2024-35889 Link following in QNAP QTS CVSS 4.0HIGH 8.7
  • TI-2024-17986 Buffer overflow in QNAP QTS CVSS 3.1HIGH 8.8
  • TI-2024-14559 Improper authentication in QNAP QTS CVSS 3.1CRITICAL 9.8
  • TI-2023-09214 OS command injection in QNAP QTS CVSS 3.1CRITICAL 9.8
See all 233 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences