This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] QNAP fixes 25 vulnerabilities

QNAP fixes 25 vulnerabilities in its products. The most severe of them are described below. Products and their fixes: File Station - 5.5.6.4847 [1], 5.5.6.4791 [2] QTS - 5.2.4.3079 build 20250321 [3], 5.2.4.3079 build 20250321 [4] QuTS hero - h5.2.4.3079 build 20250321 [3], h5.2.4.3079 build 20250321[4] Qsync Central - 4.5.0.6 [5] QES - 2.2.1 build 20250304 [6], 2.2.1 build 20241231 [7] QuRouter - 2.5.0.140 [8] License Center - 1.9.49 [9]

QNAP File Station 5 - improper certificate validation (CVE-2025-30279, CVE-2025-33031)
CVSS 8.3 (High)

An authenticated remote attacker can gain access to a user account and compromise the security of the given system in File Station 5 [1].

The vulnerability is present in product:

  • *:File Station; >=5.5.0, <5.5.6.4847

CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

More information:

The vulnerability was publicly disclosed 7. 6. 2025.

QNAP File Station 5 - path traversal (CVE-2025-33035)
CVSS 7.2 (High)

An authenticated remote attacker can read the contents of sensitive files or system data in File Station 5 [1].

The vulnerability is present in product:

  • *:File Station; >=5.5.0, <5.5.6.4847

CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

More information:

  • CVE-2025-33035 at cve.org, NVD
  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') at cwe.mitre.org

The vulnerability was publicly disclosed 7. 6. 2025.

QNAP File Station 5 - DoS (CVE-2025-22484, CVE-2025-29872)
CVSS 7.1 (High)

An authenticated remote attacker can prevent other systems, applications or processes from accessing the same type of resource in File Station 5 [1].

The vulnerability is present in product:

  • *:File Station; >=5.5.0, <5.5.6.4847

CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

More information:

The vulnerability was publicly disclosed 7. 6. 2025.

QNAP File Station 5 - improper certificate validation (CVE-2025-22486, CVE-2025-29883, CVE-2025-29884, CVE-2025-29885)
CVSS 7.1 (High)

An authenticated remote attacker can compromise the security of the system in File Station 5 due to improper certificate validation [2].

The vulnerability is present in product:

  • *:File Station; >=5.5.0, <5.5.6.4791

CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

More information:

The vulnerability was publicly disclosed 7. 6. 2025.

QNAP QTS, QuTS hero - command injection (CVE-2025-22481)
CVSS 8.7 (High)

An authenticated remote attacker can execute arbitrary commands in QTS and QuTS hero [3].

The vulnerability is present in products:

  • *:QTS; >=5.2.0, <5.2.4.3079 build 20250321
  • *:QuTS hero; >=h5.2.0, <h5.2.4.3079 build 20250321

CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

More information:

  • CVE-2025-22481 at cve.org, NVD
  • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 7. 6. 2025.

QNAP Qsync Central - SQL injection (CVE-2025-29892)
CVSS 8.7 (High)

An authenticated remote attacker can execute arbitrary code or commands in Qsync Central [5].

The vulnerability is present in product:

  • *:Qsync Central; >=4.5.0, <4.5.0.6

CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

More information:

  • CVE-2025-29892 at cve.org, NVD
  • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 7. 6. 2025.

By CESNET, z.s.p.o. Michaela Jarošová on 11. 6. 2025.

CESNET, z.s.p.o. Logo