CVE-2025-22481: QTS, QuTS hero

Q: What is the severity of CVE-2025-22481?

CVE-2025-22481 is classified as a high-severity command injection vulnerability affecting QNAP operating systems.

Q: How do I fix CVE-2025-22481?

To fix CVE-2025-22481, upgrade to QNAP QTS version 5.2.4.3079 or QuTS hero version h5.2.4.3079 or later.

Q: Who is affected by CVE-2025-22481?

CVE-2025-22481 affects users of QNAP QTS and QuTS hero prior to the specified fixed versions.

Q: What type of attacks can exploit CVE-2025-22481?

CVE-2025-22481 allows remote attackers with user access to execute arbitrary commands on the affected systems.

Q: When was CVE-2025-22481 reported?

CVE-2025-22481 was reported recently and details were disclosed by QNAP in a security advisory.

Published Jun 6, 2025

Updated

A command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained user access to execute arbitrary commands.

We have already fixed the vulnerability in the following versions: QTS 5.2.4.3079 build 20250321 and later QuTS hero h5.2.4.3079 build 20250321 and later

Affected Software

25 affected components

QNAP QTS<5.2.4.3079

QNAP QuTS hero<h5.2.4.3079

QNAP QTS=5.2.0.2737-build_20240417

QNAP QTS=5.2.0.2744-build_20240424

QNAP QTS=5.2.0.2782-build_20240601

QNAP QTS=5.2.0.2802-build_20240620

QNAP QTS=5.2.0.2823-build_20240711

QNAP QTS=5.2.0.2851-build_20240808

QNAP QTS=5.2.0.2860-build_20240817

QNAP QTS=5.2.1.2930-build_20241025

QNAP QTS=5.2.2.2950-build_20241114

QNAP QTS=5.2.3.3006-build_20250108

QNAP QTS=5.2.4.3070-build_20250312

QNAP QuTS hero=h5.2.0.2737-build_20240417

QNAP QuTS hero=h5.2.0.2782-build_20240601

QNAP QuTS hero=h5.2.0.2789-build_20240607

QNAP QuTS hero=h5.2.0.2802-build_20240620

QNAP QuTS hero=h5.2.0.2823-build_20240711

QNAP QuTS hero=h5.2.0.2851-build_20240808

QNAP QuTS hero=h5.2.0.2860-build_20240817

QNAP QuTS hero=h5.2.1.2929-build_20241025

QNAP QuTS hero=h5.2.1.2940-build_20241105

QNAP QuTS hero=h5.2.2.2952-build_20241116

QNAP QuTS hero=h5.2.3.3006-build_20250108

QNAP QuTS hero=h5.2.4.3070-build_20250312

Remediation

Information

We have already fixed the vulnerability in the following versions: QTS 5.2.4.3079 build 20250321 and later QuTS hero h5.2.4.3079 build 20250321 and later

Event History

Jun 6, 2025

CVE Published

via MITRE·03:53 PM

Data Sourced

via MITRE·03:53 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·04:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-22481?

CVE-2025-22481 is classified as a high-severity command injection vulnerability affecting QNAP operating systems.

How do I fix CVE-2025-22481?