QTS, QuTS hero_CVE-2025-54165

4.6 / 10

MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U

Description

An out-of-bounds read vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret data.

We have already fixed the vulnerability in the following versions:
QTS 5.2.7.3256 build 20250913 and later
QuTS hero h5.2.7.3256 build 20250913 and later
QuTS hero h5.3.1.3250 build 20250912 and later

Basic Information

ID CVE-2025-54165

Source qnap

Published Jan 2, 2026 at 14:56

Affected Product

Vendor QNAP Systems Inc.

Product QTS

Version 5.2.x

Affected Versions QNAP Systems Inc. QTS 5.2.x
QNAP Systems Inc. QuTS hero h5.2.x
QNAP Systems Inc. QuTS hero h5.3.x

CWE Classification

CWE-125

References

www.qnap.com /en/security-advisory/qsa-25-50

{
    "lastseen": "",
    "description": "An out-of-bounds read vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret data.\n\nWe have already fixed the vulnerability in the following versions:\nQTS 5.2.7.3256 build 20250913 and later\nQuTS hero h5.2.7.3256 build 20250913 and later\nQuTS hero h5.3.1.3250 build 20250912 and later",
    "published": "2026-01-02T14:56:54.985Z",
    "modified": "2026-01-02T14:56:54.985Z",
    "type": "cve",
    "title": "QTS, QuTS hero",
    "source": "qnap",
    "references": "https://www.qnap.com/en/security-advisory/qsa-25-50",
    "id": "CVE-2025-54165",
    "bulletinFamily": "",
    "cwe": [
        "CWE-125"
    ],
    "cvelist": null,
    "sourceData": "QNAP Systems Inc. QTS 5.2.x\nQNAP Systems Inc. QuTS hero h5.2.x\nQNAP Systems Inc. QuTS hero h5.3.x",
    "sourceHref": "",
    "cvss": {
        "score": 4.6,
        "severity": "MEDIUM",
        "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U",
        "version": "4.0"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "QTS",
    "version": "5.2.x",
    "vendor": "QNAP Systems Inc.",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}