CVE-2025-52853 Overview
CVE-2025-52853 is a NULL pointer dereference vulnerability [CWE-476] affecting multiple versions of QNAP QTS and QuTS hero operating systems. An authenticated remote attacker with administrator privileges can trigger the flaw to cause a denial-of-service (DoS) condition on the affected NAS device. QNAP has released fixed builds in QTS 5.2.6.3195 build 20250715 and QuTS hero h5.2.6.3195 build 20250715. The vulnerability was disclosed in QNAP Security Advisory QSA-25-36 and published to the National Vulnerability Database (NVD) on October 3, 2025.
Critical Impact
An authenticated administrator can remotely crash the QTS or QuTS hero service, disrupting storage availability for connected clients and dependent workloads.
Affected Products
- QNAP QTS versions from 5.2.0.2737 (build 20240417) through 5.2.5.3145 (build 20250526)
- QNAP QuTS hero versions from h5.2.0.2737 (build 20240417) through h5.2.5.3138 (build 20250519)
- Fixed in QTS 5.2.6.3195 build 20250715 and QuTS hero h5.2.6.3195 build 20250715
Discovery Timeline
- 2025-10-03 - CVE-2025-52853 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-52853
Vulnerability Analysis
The flaw is a NULL pointer dereference [CWE-476] in the QTS and QuTS hero operating systems. When a specific administrative code path receives crafted input, the software dereferences a pointer that was never assigned a valid memory address. The resulting access violation terminates the affected process and produces a denial-of-service condition. QNAP's advisory classifies the impact as availability loss with no confidentiality or integrity impact. Exploitation requires an authenticated administrator account, which raises the barrier to abuse but does not eliminate risk in environments where credentials are shared, reused, or previously exposed.
Root Cause
The vulnerability stems from missing validation of a pointer before it is dereferenced within a QTS or QuTS hero system component. Under normal conditions the pointer is initialized through a preceding call, but a specific request path allows the code to proceed without that initialization. Accessing memory through the uninitialized pointer crashes the responsible service.
Attack Vector
The attack is network-reachable and requires high privileges. An attacker who obtains or compromises an administrator account can send a crafted request over the network to trigger the crash. No user interaction is required. Because QTS administrator sessions expose storage, backup, and virtualization services, a service crash can cascade into loss of file shares, iSCSI targets, and hosted virtual machines until the process or appliance is restarted.
No public proof-of-concept exploit is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. See the QNAP Security Advisory QSA-25-36 for vendor-provided technical context.
Detection Methods for CVE-2025-52853
Indicators of Compromise
- Unexpected termination or restart of QTS or QuTS hero system daemons handling administrative requests
- Kernel or user-space crash entries referencing NULL address access in /var/log or the System Event Log
- Loss of connectivity to file shares, iSCSI targets, or QNAP management services following an administrator-authenticated request
Detection Strategies
- Monitor QNAP System Connection Logs for administrator logins from unfamiliar IP addresses or geographies
- Alert on repeated service restarts of QTS or QuTS hero components within short time windows
- Correlate administrator API activity against baseline behavior to surface anomalous request patterns preceding a crash
Monitoring Recommendations
- Forward QNAP syslog output to a centralized logging platform for retention and correlation
- Enable two-factor authentication on all administrator accounts and audit privileged account inventory quarterly
- Track running firmware versions across NAS fleets to identify devices still on vulnerable builds
How to Mitigate CVE-2025-52853
Immediate Actions Required
- Upgrade QTS to 5.2.6.3195 build 20250715 or later
- Upgrade QuTS hero to h5.2.6.3195 build 20250715 or later
- Rotate administrator credentials and review recent privileged logins for anomalies
- Restrict administrative interface exposure to trusted management networks
Patch Information
QNAP has fixed the vulnerability in QTS 5.2.6.3195 build 20250715 and QuTS hero h5.2.6.3195 build 20250715. Administrators can apply the update through the QTS Control Panel under System > Firmware Update > Live Update, or by downloading the firmware from the QNAP Download Center. Details are available in QNAP Security Advisory QSA-25-36.
Workarounds
- Limit administrator account membership to the minimum required personnel
- Block administrative ports from the public internet and require VPN access for remote management
- Enforce strong password policies and enable two-factor authentication for all administrator accounts
- Enable IP allow-lists and connection rate limiting on the QNAP management interface
# Verify installed QTS or QuTS hero build after patching
getcfg System Version -f /etc/config/uLinux.conf
getcfg System "Build Number" -f /etc/config/uLinux.conf
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
