CVE-2025-9110: QNAP QTS Information Disclosure Flaw

CVE-2025-9110 Overview

CVE-2025-9110 is an exposure of sensitive system information to an unauthorized control sphere vulnerability affecting multiple QNAP NAS operating system versions. This information disclosure flaw allows remote attackers to read application data from affected QNAP devices without proper authorization.

QNAP Network Attached Storage (NAS) devices are widely deployed in enterprise and home environments for centralized data storage and backup. The vulnerability impacts both QTS (QNAP Turbo NAS System) and QuTS hero operating systems, which power QNAP's consumer and enterprise-grade storage solutions respectively.

Critical Impact

Remote attackers can exploit this vulnerability to access sensitive application data on affected QNAP NAS devices, potentially exposing confidential information stored on network storage systems.

Affected Products

• QNAP QTS versions prior to 5.2.8.3332 build 20251128
• QNAP QuTS hero versions prior to h5.2.8.3321 build 20251117
• QNAP QuTS hero versions prior to h5.3.1.3250 build 20250912

Discovery Timeline

• 2026-01-02 - CVE-2025-9110 published to NVD
• 2026-01-06 - Last updated in NVD database

Technical Details for CVE-2025-9110

Vulnerability Analysis

This vulnerability is classified under CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere). The flaw occurs when the QNAP operating system inadvertently exposes internal system or application data to entities that should not have access to such information.

The vulnerability can be exploited remotely over the network, requiring no authentication or user interaction. An attacker positioned on the network can send crafted requests to the vulnerable QNAP device to extract sensitive application data. While the confidentiality impact is limited in scope, the ease of exploitation (no special privileges or user interaction required) makes this vulnerability concerning for organizations with internet-exposed QNAP devices.

The affected QTS and QuTS hero versions span multiple builds from April 2024 through October 2025, indicating that the vulnerable code has been present in the QNAP operating system for an extended period.

Root Cause

The root cause of CVE-2025-9110 stems from improper information handling within the QNAP operating system. Sensitive system information is exposed to an unauthorized control sphere, meaning that data intended for internal system use only is accessible to external, unauthenticated parties. This type of vulnerability typically arises from:

• Insufficient access controls on system information endpoints
• Improper filtering of sensitive data in API responses
• Debug or diagnostic information being exposed in production environments
• Missing authentication checks on information disclosure vectors

Attack Vector

The attack vector for this vulnerability is network-based. Remote attackers can exploit the flaw without requiring any prior authentication to the QNAP device. The attack does not require any user interaction, meaning exploitation can occur entirely automatically once an attacker identifies a vulnerable target.

Potential attack scenarios include:

• Reconnaissance attacks to gather system configuration details
• Extraction of application-specific data that may reveal sensitive operational information
• Information gathering as a precursor to more targeted attacks against the QNAP device

The vulnerability does not impact system integrity or availability—the exposure is limited to confidentiality of application data.

Detection Methods for CVE-2025-9110

Indicators of Compromise

• Unusual network traffic patterns to QNAP device management interfaces from external sources
• Unexpected access attempts to system information endpoints without valid authentication
• Log entries showing repeated information queries from unrecognized IP addresses
• Anomalous data transfer volumes from QNAP devices to external destinations

Detection Strategies

• Monitor network traffic for suspicious requests to QNAP web interfaces and API endpoints
• Review QNAP system logs for unauthorized access attempts or information disclosure events
• Implement network segmentation monitoring to detect lateral movement targeting NAS devices
• Deploy intrusion detection rules to identify reconnaissance activity against QNAP services

Monitoring Recommendations

• Enable comprehensive logging on QNAP devices and forward logs to a centralized SIEM
• Configure alerts for access attempts to QNAP management interfaces from non-whitelisted IP ranges
• Regularly audit which systems and users are accessing the QNAP device
• Monitor for firmware version checks and update notifications from QNAP

How to Mitigate CVE-2025-9110

Immediate Actions Required

• Update QTS to version 5.2.8.3332 build 20251128 or later immediately
• Update QuTS hero to version h5.2.8.3321 build 20251117 or later for 5.2.x deployments
• Update QuTS hero to version h5.3.1.3250 build 20250912 or later for 5.3.x deployments
• Restrict network access to QNAP management interfaces using firewall rules
• Avoid exposing QNAP devices directly to the internet without VPN protection

Patch Information

QNAP has released security patches to address CVE-2025-9110 in the following versions:

For detailed patch information and download links, refer to the QNAP Security Advisory QSA-25-51.

Workarounds

• Place QNAP devices behind a firewall and restrict access to trusted networks only
• Disable unnecessary services and ports on the QNAP device
• Use VPN access for remote management instead of exposing management interfaces directly
• Implement network segmentation to isolate NAS devices from untrusted network segments
• Enable IP access protection features in QNAP settings to limit connection sources

# Example: Restrict access to QNAP management port using iptables on network perimeter
iptables -A INPUT -p tcp --dport 8080 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP
iptables -A INPUT -p tcp --dport 443 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP