Multiple vulnerabilities in QNAP QTS and QuTS hero
| Risk | Medium |
| Patch available | YES |
| Number of vulnerabilities | 2 |
| CVE-ID | CVE-2025-26465 CVE-2025-26466 |
| CWE-ID | CWE-300 CWE-20 |
| Exploitation vector | Network |
| Public exploit | Public exploit code for vulnerability #2 is available. |
| Vulnerable software |
QuTS hero Hardware solutions / Firmware QNAP QTS Server applications / File servers (FTP/HTTP) |
| Vendor | QNAP Systems, Inc. |
Security Bulletin
This security bulletin contains information about 2 vulnerabilities.
1) Man-in-the-Middle (MitM) attack
EUVDB-ID: #VU104035
Risk: Medium
CVSSv4.0: 2.1 [CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2025-26465
CWE-ID:
CWE-300 - Channel Accessible by Non-Endpoint ('Man-in-the-Middle')
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform MitM attack.
The
vulnerability exists due to incorrect processing of user-supplied data
in ssh(1). A remote attacker can perform server impersonation when
VerifyHostKeyDNS enabled.
Install update from vendor's website.
Vulnerable software versionsQuTS hero: before h5.2.4.3079 build 20250321
QNAP QTS: before
CPE2.3 External linkshttps://www.qnap.com/en/security-advisory/qsa-25-14
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Input validation error
EUVDB-ID: #VU104034
Risk: Medium
CVSSv4.0: 7.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/U:Green]
CVE-ID: CVE-2025-26466
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: Yes
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input related to SSH2_MSG_PING handling in sshd(8). A remote attacker can send specially crafted packets to the server and perform a denial of service (DoS) attack.
MitigationInstall update from vendor's website.
Vulnerable software versionsQuTS hero: before h5.2.4.3079 build 20250321
QNAP QTS: before
CPE2.3 External linkshttps://www.qnap.com/en/security-advisory/qsa-25-14
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
