QTS, QuTS hero_CVE-2025-66281

6.9 / 10

MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Description

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following versions:
QTS 5.2.9.3410 build 20260214 and later
QuTS hero h5.2.9.3410 build 20260214 and later
QuTS hero h5.3.4.3500 build 20260520 and later
QuTS hero h6.0.0.3397 build 20260206 and later

Basic Information

ID CVE-2025-66281

Source qnap

Published Jun 10, 2026 at 03:06

Affected Product

Vendor QNAP Systems Inc.

Product QTS

Version 5.2.0

Affected Versions QNAP Systems Inc. QTS 5.2.0
QNAP Systems Inc. QuTS hero h5.2.0
QNAP Systems Inc. QuTS hero h5.3.0
QNAP Systems Inc. QuTS hero ?

CWE Classification

CWE-476

References

www.qnap.com /en/security-advisory/qsa-26-10

{
    "lastseen": "",
    "description": "A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to launch a denial-of-service (DoS) attack.\n\nWe have already fixed the vulnerability in the following versions:\nQTS 5.2.9.3410 build 20260214 and later\nQuTS hero h5.2.9.3410 build 20260214 and later\nQuTS hero h5.3.4.3500 build 20260520 and later\nQuTS hero h6.0.0.3397 build 20260206 and later",
    "published": "2026-06-10T03:06:06.429Z",
    "modified": "2026-06-10T03:06:06.429Z",
    "type": "cve",
    "title": "QTS, QuTS hero",
    "source": "qnap",
    "references": "https://www.qnap.com/en/security-advisory/qsa-26-10",
    "id": "CVE-2025-66281",
    "bulletinFamily": "",
    "cwe": [
        "CWE-476"
    ],
    "cvelist": null,
    "sourceData": "QNAP Systems Inc. QTS 5.2.0\nQNAP Systems Inc. QuTS hero h5.2.0\nQNAP Systems Inc. QuTS hero h5.3.0\nQNAP Systems Inc. QuTS hero ?",
    "sourceHref": "",
    "cvss": {
        "score": 6.9,
        "severity": "MEDIUM",
        "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
        "version": "4.0"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "QTS",
    "version": "5.2.0",
    "vendor": "QNAP Systems Inc.",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}