CVE-2025-52854: QNAP QTS NULL Pointer Dereference DoS

CVE-2025-52854 Overview

CVE-2025-52854 is a NULL pointer dereference vulnerability [CWE-476] affecting multiple versions of QNAP QTS and QuTS hero operating systems. A remote attacker who has already obtained administrator credentials can trigger the flaw to cause a denial-of-service (DoS) condition on the affected network-attached storage (NAS) device. QNAP addressed the issue in QTS 5.2.6.3195 build 20250715 and QuTS hero h5.2.6.3195 build 20250715. The flaw is tracked under QNAP Security Advisory QSA-25-36.

Critical Impact
Authenticated administrators can remotely crash QNAP QTS and QuTS hero services, disrupting storage availability for all users of the affected NAS appliance.

Affected Products

QNAP QTS versions prior to 5.2.6.3195 build 20250715
QNAP QuTS hero versions prior to h5.2.6.3195 build 20250715
QNAP NAS appliances running the vulnerable firmware builds listed in QSA-25-36

Discovery Timeline

2025-10-03 - CVE-2025-52854 published to the National Vulnerability Database
2026-10-18 - Last updated in NVD database

Technical Details for CVE-2025-52854

Vulnerability Analysis

The vulnerability is a NULL pointer dereference in the QNAP QTS and QuTS hero operating systems. When a specific code path receives unexpected input from an authenticated administrator, it dereferences a pointer without first validating that it references a valid memory object. The dereference triggers a process crash, resulting in denial of service for the affected component. Because QTS and QuTS hero manage storage services central to the NAS, the crash can impact file access, management interfaces, and dependent services.

The flaw requires high privileges, meaning the attacker must already hold an administrator account on the device. Exploitation does not require user interaction and can be performed over the network. The impact is limited to availability; confidentiality and integrity of stored data are not directly affected by the dereference itself.

Root Cause

The root cause is missing validation of a pointer prior to dereference within the vulnerable QTS and QuTS hero component. Code paths reachable by administrator-authenticated requests assume a pointer is non-NULL without enforcing that condition, satisfying the conditions described by CWE-476.

Attack Vector

An attacker first obtains administrator credentials on the target QNAP NAS through credential theft, brute force, phishing, or reuse of previously compromised credentials. The attacker then sends a crafted request to the vulnerable interface over the network. The request triggers the NULL pointer dereference and crashes the service, producing a denial-of-service condition. Repeated exploitation can keep the service unavailable until the device is restarted or the condition is otherwise cleared.

No public proof-of-concept exploit is listed for this CVE, and it is not present in the CISA Known Exploited Vulnerabilities catalog. Refer to the QNAP Security Advisory QSA-25-36 for vendor technical detail.

Detection Methods for CVE-2025-52854

Indicators of Compromise

Unexpected crash or restart of QTS or QuTS hero services on the NAS appliance
Administrator-authenticated requests to management interfaces immediately preceding a service outage
Repeated service availability loss correlated with administrator session activity from unexpected source IP addresses

Detection Strategies

Monitor QNAP system logs for abnormal process termination events and service restart messages
Correlate administrator login events with subsequent crash signatures to identify abuse patterns
Alert on administrator authentications from new geolocations, ASNs, or source IP ranges not previously observed

Monitoring Recommendations

Forward QNAP syslog output to a central log collector or SIEM for retention and correlation
Baseline normal administrator activity windows and alert on deviations
Track firmware versions across the NAS fleet to identify devices still running vulnerable builds

How to Mitigate CVE-2025-52854

Immediate Actions Required

Upgrade QTS to version 5.2.6.3195 build 20250715 or later as specified in QSA-25-36
Upgrade QuTS hero to version h5.2.6.3195 build 20250715 or later
Rotate administrator credentials and enforce strong, unique passwords on all QNAP accounts
Enable two-step verification for administrator accounts on the NAS

Patch Information

QNAP has released fixed firmware in QTS 5.2.6.3195 build 20250715 and QuTS hero h5.2.6.3195 build 20250715. Apply the update through the QTS web interface under Control Panel > System > Firmware Update, or download the firmware image directly from the QNAP support portal. Review the QNAP Security Advisory QSA-25-36 for the complete list of affected builds and remediation guidance.

Workarounds

Restrict access to the NAS management interface to trusted internal networks or VPN clients only
Remove the NAS from direct Internet exposure and disable port forwarding to management services
Limit the number of administrator accounts and audit the membership of the administrators group
Enable account lockout policies and failed-login alerting to reduce the risk of credential compromise

bash

# Example: restrict QNAP management access with firewall rules
# Replace 10.0.0.0/24 with your trusted management network
iptables -A INPUT -p tcp --dport 8080 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP
iptables -A INPUT -p tcp --dport 443  -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443  -j DROP