CVE-2025-33032
MediumCVSS 4.9Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data.
Risk Assessment
An attacker with administrator privileges can access sensitive files and system data, potentially leading to further privilege escalation or information disclosure. The vulnerability affects QNAP devices running QTS and QuTS hero.
Recommendation
Update QTS to version 5.2.5.3145 build 20250526 or later, and QuTS hero to version h5.2.5.3138 build 20250519 or later. It is also recommended to restrict administrative access to trusted networks.
Other vulnerabilities in QNAP QTS/QuTS hero
See all- CVE-2020-2509CriticalActively exploited
A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application.
- CVE-2025-30273High
An out-of-bounds write vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to modify or corrupt memory.
- CVE-2025-30271Medium
A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.
- CVE-2025-30270Medium
A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.
- CVE-2025-30264High
A command injection vulnerability has been reported to affect several QNAP operating system versions. A remote attacker who gains a user account can exploit the vulnerability to execute arbitrary commands.
Original NVD description (English source)
A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: QTS 5.2.5.3145 build 20250526 and later QuTS hero h5.2.5.3138 build 20250519 and later
Vulnerability data from NVD (NIST) · CISA KEV · EPSS