CVE-2025-48730: QNAP QTS Format String Vulnerability

CVE-2025-48730 Overview

CVE-2025-48730 is a format string vulnerability affecting QNAP QTS and QuTS hero operating systems. The flaw stems from use of an externally-controlled format string [CWE-134] within the QNAP operating system. A remote attacker who has already obtained an administrator account can exploit the issue to read secret data from memory or modify memory contents. QNAP addressed the vulnerability in QTS 5.2.6.3195 build 20250715 and QuTS hero h5.2.6.3195 build 20250715.

Critical Impact
Authenticated administrators can leverage the format string flaw to disclose sensitive memory contents or perform memory modification on affected QNAP NAS devices.

Affected Products

QNAP QTS versions prior to 5.2.6.3195 build 20250715
QNAP QuTS hero versions prior to h5.2.6.3195 build 20250715
QNAP NAS appliances running the affected firmware builds listed in advisory QSA-25-36

Discovery Timeline

2025-10-03 - CVE-2025-48730 published to NVD
2026-10-18 - Last updated in NVD database

Technical Details for CVE-2025-48730

Vulnerability Analysis

The vulnerability is classified under [CWE-134] Use of Externally-Controlled Format String. Affected QNAP operating system components pass attacker-influenced input directly into a format-string argument of functions in the printf family. Because the format specifiers are not fixed by the developer, an authenticated administrator can supply conversion specifiers such as %x, %s, or %n to read stack memory or write to arbitrary memory addresses. The resulting primitives support disclosure of sensitive runtime data and controlled memory corruption inside the affected service process.

Root Cause

The root cause is improper handling of user-supplied strings that reach formatting routines without sanitization or a hardcoded format template. QNAP corrected the issue by refactoring the affected call sites so that external input is treated strictly as data rather than as a format specifier.

Attack Vector

Exploitation requires network access to the QNAP administrative interface and valid administrator credentials. After authentication, the attacker submits crafted input to the vulnerable component that is then processed as a format string. The attack vector is remote over the network, but the high privilege requirement limits exploitation to compromised or malicious administrator accounts. No user interaction is required beyond the attacker's own authenticated session.

See the QNAP Security Advisory QSA-25-36 for vendor technical details.

Detection Methods for CVE-2025-48730

Indicators of Compromise

Administrator-session requests to QTS or QuTS hero management endpoints containing format specifiers such as %s, %x, %p, or %n in parameter values.
Unexpected crashes, segmentation faults, or restarts of QNAP system services recorded in device logs after administrator activity.
Administrator logins from unusual geographies, ASNs, or at atypical hours preceding anomalous management API calls.

Detection Strategies

Inspect reverse proxy, WAF, or NAS access logs for administrative requests whose body or query parameters contain repeating %-prefixed tokens.
Correlate successful administrator authentications with subsequent configuration or diagnostic API calls that return abnormally large responses.
Monitor file integrity on QNAP devices for unexpected changes to system binaries, configuration files, or scheduled tasks following administrator sessions.

Monitoring Recommendations

Forward QNAP syslog, authentication logs, and web management logs to a centralized SIEM for retention and correlation.
Alert on administrator credential use outside approved maintenance windows or from non-corporate source addresses.
Track QTS and QuTS hero firmware build strings across the fleet to confirm all appliances report a patched version.

How to Mitigate CVE-2025-48730

Immediate Actions Required

Upgrade QTS to 5.2.6.3195 build 20250715 or later, and QuTS hero to h5.2.6.3195 build 20250715 or later.
Rotate credentials for every administrator account on affected appliances and audit the account list for unauthorized additions.
Restrict administrative access to the QNAP management interface to trusted management networks or VPN segments.
Enforce multi-factor authentication for all administrator logins to raise the barrier for credential-based abuse.

Patch Information

QNAP has released fixed firmware in QTS 5.2.6.3195 build 20250715 and QuTS hero h5.2.6.3195 build 20250715. Patch details and upgrade instructions are published in the QNAP Security Advisory QSA-25-36. Apply the firmware update through the device's App Center or via the QNAP download center.

Workarounds

Disable remote administrative access from the public internet until the firmware upgrade is applied.
Limit the number of accounts with administrator privileges and remove any dormant or shared administrator accounts.
Place QNAP management interfaces behind a VPN or jump host to prevent direct exposure to untrusted networks.

bash

# Verify QNAP firmware version from the device CLI
getcfg System Version
getcfg System "Build Number"

# Confirm the installed build is at or above the patched release
# QTS:        5.2.6.3195 build 20250715
# QuTS hero:  h5.2.6.3195 build 20250715