SB2026010585 - Multiple vulnerabilities in QNAP QTS and QuTS hero

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026010585

SB2026010585 - Multiple vulnerabilities in QNAP QTS and QuTS hero

Published: January 5, 2026

Security Bulletin ID SB2026010585
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 20
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 25% Low 75%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 20 vulnerabilities.


1) NULL pointer dereference (CVE-ID: CVE-2025-44013)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error. A remote user can pass specially crafted data to the application and perform a denial of service (DoS) attack.


2) NULL pointer dereference (CVE-ID: CVE-2025-52426)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error. A remote administrator can pass specially crafted data to the application and perform a denial of service (DoS) attack.


3) NULL pointer dereference (CVE-ID: CVE-2025-52430)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error. A remote administrator can pass specially crafted data to the application and perform a denial of service (DoS) attack.


4) NULL pointer dereference (CVE-ID: CVE-2025-52431)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error. A remote administrator can pass specially crafted data to the application and perform a denial of service (DoS) attack.


5) NULL pointer dereference (CVE-ID: CVE-2025-53405)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error. A remote administrator can pass specially crafted data to the application and perform a denial of service (DoS) attack.


6) NULL pointer dereference (CVE-ID: CVE-2025-53414)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error. A remote administrator can pass specially crafted data to the application and perform a denial of service (DoS) attack.


7) NULL pointer dereference (CVE-ID: CVE-2025-53589)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error. A remote administrator can pass specially crafted data to the application and perform a denial of service (DoS) attack.


8) NULL pointer dereference (CVE-ID: CVE-2025-53590)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error. A remote administrator can pass specially crafted data to the application and perform a denial of service (DoS) attack.


9) NULL pointer dereference (CVE-ID: CVE-2025-53592)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error. A remote user can pass specially crafted data to the application and perform a denial of service (DoS) attack.


10) NULL pointer dereference (CVE-ID: CVE-2025-53596)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error. A remote administrator can pass specially crafted data to the application and perform a denial of service (DoS) attack.


11) Buffer overflow (CVE-ID: CVE-2025-52863)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to a boundary error. A remote user can trigger memory corruption and modify memory or crash processes on the target system.


12) Buffer overflow (CVE-ID: CVE-2025-52864)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to a boundary error. A remote user can trigger memory corruption and modify memory or crash processes on the target system.


13) Buffer overflow (CVE-ID: CVE-2025-52872)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to a boundary error. A remote user can trigger memory corruption and modify memory or crash processes on the target system.


14) Buffer overflow (CVE-ID: CVE-2025-53593)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to compromise the target system.

The vulnerability exists due to a boundary error. A remote administrator can trigger memory corruption and modify memory or crash processes on the target system.


15) Format string error (CVE-ID: CVE-2025-53591)

CWE-ID: CWE-134 - Use of Externally-Controlled Format String

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to compromise the target system.

The vulnerability exists due to a format string error. A remote administrator can supply a specially crafted input that contains format string specifiers and obtain secret data or modify memory on the target system.


16) Out-of-bounds read (CVE-ID: CVE-2025-54164)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition. A remote administrator can trigger an out-of-bounds read error and read contents of memory on the system.


17) Out-of-bounds read (CVE-ID: CVE-2025-54165)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition. A remote administrator can trigger an out-of-bounds read error and read contents of memory on the system.


18) Out-of-bounds read (CVE-ID: CVE-2025-54166)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition. A remote administrator can trigger an out-of-bounds read error and read contents of memory on the system.


19) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2025-47208)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to allocation of resources without limits or throttling. A remote user can pass specially crafted input to the application and perform a denial of service (DoS) attack.


20) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2025-57705)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to allocation of resources without limits or throttling. A remote administrator can pass specially crafted input to the application and perform a denial of service (DoS) attack.


Remediation

Install update from vendor's website.

References