CVE-2025-30267: QNAP QTS NULL Pointer Dereference DoS

CVE-2025-30267 Overview

CVE-2025-30267 is a NULL pointer dereference vulnerability [CWE-476] affecting multiple versions of QNAP QTS and QuTS hero operating systems. An authenticated remote attacker with a valid user account can exploit the flaw to trigger a denial-of-service (DoS) condition on the target Network Attached Storage (NAS) device. QNAP disclosed the issue in security advisory QSA-25-21 and released fixes in QTS 5.2.5.3145 build 20250526 and QuTS hero h5.2.5.3138 build 20250519. The vulnerability carries a CVSS v4.0 score of 5.3 (Medium) and requires low privileges with no user interaction, making it feasible for any attacker who has obtained credentials to disrupt NAS availability.

Critical Impact
An authenticated remote attacker can crash affected QNAP QTS and QuTS hero systems, disrupting storage services and any workloads that depend on the NAS.

Affected Products

QNAP QTS 5.2.x builds prior to 5.2.5.3145 build 20250526
QNAP QuTS hero h5.2.x builds prior to h5.2.5.3138 build 20250519
QNAP NAS appliances running the affected QTS or QuTS hero firmware releases

Discovery Timeline

2025-08-29 - CVE-2025-30267 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30267

Vulnerability Analysis

The vulnerability is a NULL pointer dereference in QNAP's QTS and QuTS hero operating systems. When a specific code path executes without validating that a pointer references a valid object, the process dereferences a NULL address and crashes. On QNAP appliances, this results in a service or component failure that produces a denial-of-service condition.

Exploitation requires an authenticated session, so the attacker must first obtain valid credentials through phishing, credential reuse, brute force, or a prior compromise. Once authenticated, the attacker can reach the vulnerable code path over the network and trigger the crash without user interaction. Because QNAP NAS devices frequently host backups, virtualization storage, and file shares, an availability failure affects downstream workloads.

Root Cause

The root cause is missing pointer validation before dereferencing an object in a QTS/QuTS hero component. QNAP's advisory attributes the issue to a NULL pointer dereference weakness [CWE-476]. The fixed firmware adds the required validation and error handling to prevent the crash condition.

Attack Vector

The attack vector is network-based and requires low privileges (PR:L). A remote attacker holding a valid QTS or QuTS hero user account sends a crafted request to the exposed service. The request drives execution into the vulnerable path, causing the process or subsystem to terminate and interrupting NAS operations until service or device recovery. No exploit is publicly available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detailed proof-of-concept material has not been published. Refer to the QNAP Security Advisory QSA-25-21 for vendor guidance.

Detection Methods for CVE-2025-30267

Indicators of Compromise

Unexpected service crashes, restarts, or watchdog-triggered reboots on QNAP QTS or QuTS hero appliances.
QTS/QuTS hero system logs recording abnormal process termination or segmentation faults tied to an authenticated session.
Authenticated sessions from unusual source IPs immediately preceding an availability incident on the NAS.

Detection Strategies

Correlate NAS authentication events with subsequent service failures to identify sessions that consistently precede crashes.
Alert on repeated abnormal terminations of QTS/QuTS hero services within short time windows on the same host.
Track firmware versions across the NAS fleet and flag devices still running builds listed in the affected CPE range.

Monitoring Recommendations

Forward QTS and QuTS hero system logs to a centralized SIEM or data lake for correlation with identity and network telemetry.
Monitor administrative and user login activity on NAS appliances for anomalies, including geographic and time-of-day outliers.
Establish availability monitoring for NAS-hosted shares, iSCSI targets, and backup jobs so DoS events are detected quickly.

How to Mitigate CVE-2025-30267

Immediate Actions Required

Update QTS to 5.2.5.3145 build 20250526 or later, and QuTS hero to h5.2.5.3138 build 20250519 or later.
Audit local and domain-linked NAS user accounts, disable unused accounts, and rotate credentials for accounts with broad access.
Restrict network reachability of NAS management and service interfaces to trusted administrative networks or VPN segments.
Enforce multi-factor authentication (MFA) for all QTS and QuTS hero user accounts where supported.

Patch Information

QNAP addressed CVE-2025-30267 in QTS 5.2.5.3145 build 20250526 and QuTS hero h5.2.5.3138 build 20250519. Apply the firmware update through the QTS/QuTS hero web console under Control Panel > System > Firmware Update, or via QNAP's Live Update mechanism. Full remediation guidance is documented in the QNAP Security Advisory QSA-25-21.

Workarounds

Limit exposure of NAS services to the public internet by placing appliances behind a firewall or VPN until patching is complete.
Reduce the number of accounts with remote access rights and enforce strong, unique passwords to raise the barrier for authenticated exploitation.
Enable QNAP's built-in IP access protection and account lockout policies to slow credential-based access to the vulnerable endpoint.

bash

# Verify installed QTS/QuTS hero firmware version via SSH
getcfg -f /etc/config/uLinux.conf System Version
getcfg -f /etc/config/uLinux.conf System "Build Number"

# Confirm the running build is at or above the fixed release:
#   QTS       >= 5.2.5.3145 build 20250526
#   QuTS hero >= h5.2.5.3138 build 20250519