CVE-2025-47212: QNAP QTS RCE Vulnerability

CVE-2025-47212 Overview

CVE-2025-47212 is a command injection vulnerability [CWE-78] affecting QNAP QTS and QuTS hero network-attached storage (NAS) operating systems. The flaw allows a remote attacker who has obtained administrator credentials to execute arbitrary operating system commands on the affected device. QNAP disclosed the issue in security advisory QSA-25-36 and released fixes in QTS 5.2.6.3195 build 20250715 and QuTS hero h5.2.6.3195 build 20250715.

The vulnerability requires high privileges, which limits its standalone impact. However, attackers who chain it with credential theft, phishing, or other authentication weaknesses can leverage it to gain shell-level control of NAS appliances that frequently host backups and sensitive enterprise data.

Critical Impact
An authenticated administrator can execute arbitrary commands on QNAP NAS devices running vulnerable QTS or QuTS hero builds, enabling persistence, data theft, or lateral movement.

Affected Products

QNAP QTS versions prior to 5.2.6.3195 build 20250715
QNAP QuTS hero versions prior to h5.2.6.3195 build 20250715
QNAP NAS appliances running affected 5.2.x firmware branches

Discovery Timeline

2025-10-03 - CVE-2025-47212 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47212

Vulnerability Analysis

The vulnerability is an operating system command injection [CWE-78] in QNAP's QTS and QuTS hero firmware. An administrator-authenticated request reaches a code path that constructs a shell command using attacker-influenced input without proper sanitization or argument separation. The injected metacharacters break out of the intended command context and execute additional commands under the privileges of the calling process.

The flaw is reachable over the network, meaning an attacker who possesses valid administrator credentials does not require local console access. QNAP has not published exploitation details, and no public proof-of-concept exists at the time of writing. The EPSS model places exploitation probability in the moderate range.

Root Cause

The root cause is unsafe construction of shell command strings from user-supplied parameters in an administrative interface. The affected handler concatenates input directly into a command invocation rather than passing arguments through a safe API or applying strict allow-list validation. Shell metacharacters such as ;, |, &, $(), and backticks are interpreted by the underlying shell.

Attack Vector

Exploitation requires an authenticated session with administrator privileges on the QNAP web management interface. The attacker submits a crafted request to the vulnerable endpoint with payloads embedded in a parameter that feeds into the command construction. Successful exploitation yields arbitrary command execution in the context of the QTS or QuTS hero service handling the request. See the QNAP Security Advisory QSA-25-36 for vendor-supplied details.

Detection Methods for CVE-2025-47212

Indicators of Compromise

Unexpected child processes spawned by QTS or QuTS hero web service binaries, particularly /bin/sh, wget, curl, or nc.
Administrator account logins from unusual source IP addresses or geolocations followed by configuration changes.
New cron entries, startup scripts, or SSH authorized keys appearing on the NAS without administrative change records.
Outbound network connections from the NAS to unfamiliar hosts shortly after admin authentication events.

Detection Strategies

Monitor QNAP system logs and /var/log entries for shell metacharacters in administrative API parameters.
Alert on processes executed by the web management daemon that fall outside an established baseline of expected binaries.
Correlate administrator authentication events with subsequent process creation and outbound network activity on the NAS.

Monitoring Recommendations

Forward QNAP syslog data to a centralized SIEM and build detections around suspicious command patterns in administrative endpoints.
Track firmware version inventory across all QNAP devices to identify hosts still running pre-5.2.6.3195 builds.
Enable and review QNAP's built-in notification center for unexpected configuration or account changes.

How to Mitigate CVE-2025-47212

Immediate Actions Required

Upgrade QTS to version 5.2.6.3195 build 20250715 or later.
Upgrade QuTS hero to version h5.2.6.3195 build 20250715 or later.
Audit administrator accounts and rotate credentials for any account that may have been exposed.
Restrict the QNAP management interface so it is not reachable from the public internet.

Patch Information

QNAP has released fixed firmware in QTS 5.2.6.3195 build 20250715 and QuTS hero h5.2.6.3195 build 20250715. Apply updates through the QTS Control Panel under System > Firmware Update or download builds directly from the QNAP Download Center. Refer to the QNAP Security Advisory QSA-25-36 for the authoritative patch matrix.

Workarounds

Place the NAS management interface behind a VPN or firewall rule that restricts access to a small allow-list of administrative source addresses.
Enforce multi-factor authentication on all administrator accounts to raise the bar for credential-based attacks.
Disable unused administrator accounts and apply the principle of least privilege to remaining accounts.
Enable QNAP's IP access protection and account access protection to throttle brute-force attempts against admin logins.

bash

# Verify installed firmware version on a QNAP device via SSH
getcfg System Version -f /etc/config/uLinux.conf
getcfg System "Build Number" -f /etc/config/uLinux.conf

# Restrict management interface to a trusted subnet using QNAP firewall CLI
# (example pattern - validate against your QTS/QuTS hero version)
qnap-firewall add --action allow --src 10.0.0.0/24 --dst-port 8080,443
qnap-firewall add --action deny  --src 0.0.0.0/0   --dst-port 8080,443