This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] QNAP fixes 27 vulnerabilities
QNAP fixes 27 vulnerabilities in various products. Selected vulnerabilities are described below; the remaining ones can be found at [1] by clicking on the individual advisories. Products and their fixed versions: Hyper Data Protector - 2.2.4.1 [2] HBS 3 Hybrid Backup Sync - 26.2.0.938 [3] QTS - 5.2.7.3297 build 20251024 [4] QuTS hero - h5.2.7.3297 build 20251024, h5.3.1.3292 build 20251024 [4] Malware Remover - 6.6.8.20251023 [5] QuMagie - 2.7.0 [6], 2.7.3 [7] QuLog Center - 1.8.2.923 [8] Notification Center - 1.9.2.3163, 2.1.0.3443, 3.0.0.3466 [9] Qsync Central - 5.0.0.3 [10] Download Station - 5.10.0.304, 5.10.0.305 [11] File Station 5 - 5.5.6.5018 [12]
Due to an SQL injection vulnerability in the QuMagie product, an unauthenticated remote attacker can execute arbitrary code or commands [6].
The vulnerability is present in product:
- QuMagie; >=2.6.0, <2.7.0
CVSS: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
More information:
- CVE-2025-52425 at cve.org, NVD
- CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') at cwe.mitre.org
The vulnerability was publicly disclosed 8. 11. 2025.
Due to a path traversal vulnerability in the QuMagie product, an unauthenticated remote attacker can read the contents of arbitrary files or system data [7].
The vulnerability is present in product:
- QuMagie; >=2.7.0, <2.7.3
CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
More information:
- CVE-2025-58464 at cve.org, NVD
- CWE-23: Relative Path Traversal at cwe.mitre.org
The vulnerability was publicly disclosed 8. 11. 2025.
An authenticated remote attacker with access to an administrator account can bypass security mechanisms or read application data in the Notification Center product [9].
The vulnerability is present in product:
- Notification Center; >=1.9.0, <1.9.2.3163; >=2.1.0, <2.1.0.3443; >=3.0.0, <3.0.0.3466
CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:U
More information:
- CVE-2025-54167 at cve.org, NVD
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org
The vulnerability was publicly disclosed 8. 11. 2025.
Links
- [1] https://www.qnap.com/en/security-advisories
- [2] https://www.qnap.com/en/security-advisory/qsa-25-48
- [3] https://www.qnap.com/en/security-advisory/qsa-25-46
- [4] https://www.qnap.com/en/security-advisory/qsa-25-45
- [5] https://www.qnap.com/en/security-advisory/qsa-25-47
- [6] https://www.qnap.com/en/security-advisory/qsa-25-33
- [7] https://www.qnap.com/en/security-advisory/qsa-25-43
- [8] https://www.qnap.com/en/security-advisory/qsa-25-42
- [9] https://www.qnap.com/en/security-advisory/qsa-25-40
- [10] https://www.qnap.com/en/security-advisory/qsa-25-41
- [11] https://www.qnap.com/en/security-advisory/qsa-25-37
- [12] https://www.qnap.com/en/security-advisory/qsa-25-38
By CESNET, z.s.p.o. Michaela Jarošová on 12. 11. 2025.