This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] QNAP fixes 46 vulnerabilities
QNAP fixes 46 vulnerabilities in various products, the most severe of which are described below. The remaining ones can be found at [1] by clicking through the individual advisories. Products and their fixed versions: NetBak Replicator - 4.5.15.0807 [2] Qsync Central - Qsync Central 5.0.0.2 [3], 5.0.0.1 [4] Video Station - 5.8.4 [5] QNAP Authenticator - 1.3.1.1227 [6] QTS - 5.2.6.3195 build 20250715 [7] QuTS hero - h5.2.6.3195 build 20250715 [7]
Allows an authenticated local attacker who has obtained a user account to execute commands or run code without authorisation due to an untrusted file path or part of it in NetBak Replicator [2].
The vulnerability is present in product:
- NetBak Replicator; >=4.5.0, <4.5.15.0807
CVSS: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
More information:
- CVE-2025-57714 at cve.org, NVD
- CWE-428: Unquoted Search Path or Element at cwe.mitre.org
The vulnerability was publicly disclosed 4. 10. 2025.
Allows an authenticated remote attacker to perform a DoS attack due to allocation of resources without limits in Qsync Central [3].
The vulnerability is present in product:
- Qsync Central; >=5.0.0, <5.0.0.2
CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
More information:
- CVE-2025-44012 at cve.org, NVD
- CWE-770: Allocation of Resources Without Limits or Throttling at cwe.mitre.org
The vulnerability was publicly disclosed 4. 10. 2025.
Allows an authenticated remote attacker who has obtained a user account to execute commands or run code without authorisation due to an SQL injection vulnerability in Qsync Central [3].
The vulnerability is present in product:
- Qsync Central; >=5.0.0, <5.0.0.2
CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
More information:
- CVE-2025-53595 at cve.org, NVD
- CVE-2025-54153 at cve.org, NVD
- CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') at cwe.mitre.org
The vulnerability was publicly disclosed 4. 10. 2025.
Allows an authenticated remote attacker to modify or corrupt memory due to an out-of-bounds write in Qsync Central [4].
The vulnerability is present in product:
- Qsync Central; >=4.0, <5.0.0.1
CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
More information:
- CVE-2025-44014 at cve.org, NVD
- CWE-787: Out-of-bounds Write at cwe.mitre.org
The vulnerability was publicly disclosed 4. 10. 2025.
Allows an authenticated remote attacker to read the contents of unauthorised files or system data due to a path traversal vulnerability in QTS and QuTS hero [7].
The vulnerability is present in products:
- QTS; >=5.2.0, <5.2.6.3195 build 20250715
- QuTS hero; >=h5.2.0, <h5.2.6.3195 build 20250715
CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
More information:
- CVE-2025-47211 at cve.org, NVD
- CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') at cwe.mitre.org
The vulnerability was publicly disclosed 4. 10. 2025.
Links
- [1] https://www.qnap.com/en/security-advisories
- [2] https://www.qnap.com/en/security-advisory/qsa-25-39
- [3] https://www.qnap.com/en/security-advisory/qsa-25-35
- [4] https://www.qnap.com/en/security-advisory/qsa-25-34
- [5] https://www.qnap.com/en/security-advisory/qsa-25-32
- [6] https://www.qnap.com/en/security-advisory/qsa-25-30
- [7] https://www.qnap.com/en/security-advisory/qsa-25-36
By CESNET, z.s.p.o. Michaela Jarošová on 7. 10. 2025.