CVE-2025-30264
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk58th percentile - higher than 58% of all known CVEs
Summary
A command injection vulnerability has been reported to affect several QNAP operating system versions. A remote attacker who gains a user account can exploit the vulnerability to execute arbitrary commands.
Risk Assessment
An attacker with a valid user account can execute arbitrary commands on the QNAP system, potentially leading to full device compromise and access to stored data.
Recommendation
Update QTS to version 5.2.5.3145 build 20250526 or later, and QuTS hero to h5.2.5.3138 build 20250519 or later. Regularly review user accounts and limit privileges.
Other vulnerabilities in QNAP QTS/QuTS hero
See all- CVE-2020-2509CriticalActively exploited
A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application.
- CVE-2025-33032Medium
A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data.
- CVE-2025-30273High
An out-of-bounds write vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to modify or corrupt memory.
- CVE-2025-30271Medium
A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.
- CVE-2025-30270Medium
A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.
Original NVD description (English source)
A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following versions: QTS 5.2.5.3145 build 20250526 and later QuTS hero h5.2.5.3138 build 20250519 and later
Vulnerability data from NVD (NIST) · CISA KEV · EPSS