CVE-2025-52866: QNAP QTS NULL Pointer Dereference DoS Vulnerability

CVE-2025-52866 Overview

CVE-2025-52866 is a NULL pointer dereference vulnerability affecting multiple versions of QNAP QTS and QuTS hero network-attached storage operating systems. An authenticated remote attacker with administrator privileges can trigger the flaw to crash affected services and cause a denial-of-service (DoS) condition. The weakness is tracked under CWE-476 (NULL Pointer Dereference). QNAP addressed the issue in QTS 5.2.6.3195 build 20250715 and QuTS hero h5.2.6.3195 build 20250715. Administrators running earlier QTS 5.2.x or QuTS hero h5.2.x releases should update immediately to restore service availability guarantees.

Critical Impact
An attacker with a compromised administrator account can trigger a denial-of-service condition on affected QNAP NAS appliances, disrupting access to stored data and services.

Affected Products

QNAP QTS versions from 5.2.0.2737 (build 20240417) through 5.2.5.3145 (build 20250526)
QNAP QuTS hero versions from h5.2.0.2737 (build 20240417) through h5.2.5.3138 (build 20250519)
QNAP NAS appliances running the affected QTS and QuTS hero operating system builds

Discovery Timeline

2025-10-03 - CVE-2025-52866 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-52866

Vulnerability Analysis

The vulnerability is a NULL pointer dereference (CWE-476) in QNAP QTS and QuTS hero. When a specific code path in the affected operating system handles input or state from an authenticated administrative session, it dereferences a pointer without first verifying the value is non-NULL. The dereference causes the affected process or service to crash, resulting in a denial-of-service condition on the NAS appliance.

Exploitation requires a remote attacker to already hold administrator credentials. The attack is reachable over the network through standard management interfaces exposed by QTS and QuTS hero. The impact is limited to availability; QNAP does not report confidentiality or integrity consequences from this flaw.

Root Cause

The root cause is missing validation of a pointer prior to dereference inside the affected QTS and QuTS hero code paths. When the application reaches the vulnerable logic in an unexpected state, the pointer remains NULL and the subsequent memory access terminates the process. QNAP has corrected the handling in the fixed builds, ensuring the pointer is validated before use.

Attack Vector

The attack vector is network-based and requires high privileges. An attacker who has compromised or legitimately obtained an administrator account for the NAS can send a crafted request to the vulnerable interface. The malformed input or request sequence drives the affected code into the NULL dereference path, crashing the targeted service.

No public proof-of-concept, exploit code, or exploit tooling for CVE-2025-52866 is listed in Exploit-DB or the CISA Known Exploited Vulnerabilities catalog at the time of writing. Technical specifics of the vulnerable component are not disclosed in the QNAP Security Advisory QSA-25-36.

Detection Methods for CVE-2025-52866

Indicators of Compromise

Unexpected restarts or crashes of QTS or QuTS hero system services on NAS appliances running affected builds
Administrative login events from unfamiliar IP addresses or at unusual times preceding service failures
Repeated malformed or anomalous requests to management interfaces originating from a single authenticated session

Detection Strategies

Collect QNAP system logs and event notifications centrally and alert on service crash entries or kernel-level fault messages
Correlate administrator authentication events with subsequent service availability loss on the same appliance
Audit the QTS and QuTS hero build strings on all NAS appliances and flag any device running a version prior to the fixed releases

Monitoring Recommendations

Enable email and SNMP notifications in QNAP Notification Center for service crashes, failed logins, and administrator logins
Monitor availability of NAS management interfaces and SMB, NFS, or iSCSI services with external uptime checks
Review administrator account activity logs on a regular cadence and investigate any unexplained reboots or service terminations

How to Mitigate CVE-2025-52866

Immediate Actions Required

Update QTS to version 5.2.6.3195 build 20250715 or later, and QuTS hero to h5.2.6.3195 build 20250715 or later, using the Control Panel's Live Update function
Rotate all QNAP administrator passwords and enforce strong, unique credentials for every privileged account
Enable two-step verification on all administrator accounts to reduce the risk of credential compromise
Restrict management interface exposure so administrative access is only reachable from trusted internal networks or VPN clients

Patch Information

QNAP has released fixes in QTS 5.2.6.3195 build 20250715 and QuTS hero h5.2.6.3195 build 20250715. Patch details and download instructions are provided in QNAP Security Advisory QSA-25-36. Apply the update through the QTS or QuTS hero Control Panel under System > Firmware Update, or download the firmware image from the QNAP download center and install it manually.

Workarounds

Remove the NAS management interface from direct internet exposure and place it behind a VPN or firewall rule set
Limit the number of accounts with administrator privileges and apply role-based access for day-to-day operations
Review and disable unused administrator accounts, API tokens, and application passwords on the appliance

bash

# Verify current QTS or QuTS hero build on the appliance
# SSH to the NAS as an administrator and run:
getcfg -f /etc/config/uLinux.conf System Version
getcfg -f /etc/config/uLinux.conf System "Build Number"

# Confirm the value is at or above:
#   QTS:       5.2.6.3195 build 20250715
#   QuTS hero: h5.2.6.3195 build 20250715