QTS vulnerabilities

The vulnerability affects QTS (QNAP operating system). The vendor confirms QuTS hero is not affected. The fix is included in QTS 5.2.7.3256 build 20250913 and later.

This command injection vulnerability in QTS allows attackers to run arbitrary commands in the compromised application.

A NULL pointer dereference vulnerability has been reported to affect QTS, QVP, QuTS cloud, and QuTS hero. If a remote attacker gains an administrator account, they can exploit the vulnerability to launch a denial-of-service (DoS) attack.