CVE-2025-30264: QTS, QuTS hero

Q: What is the severity of CVE-2025-30264?

CVE-2025-30264 is classified as a critical command injection vulnerability.

Q: How do I fix CVE-2025-30264?

To fix CVE-2025-30264, update your QNAP operating system to version 5.2.5.3145 for QTS or 5.2.5.3138 for QuTS hero.

Q: What systems are affected by CVE-2025-30264?

CVE-2025-30264 affects several versions of QNAP's QTS and QuTS hero operating systems.

Q: How can an attacker exploit CVE-2025-30264?

An attacker can exploit CVE-2025-30264 by gaining a user account and executing arbitrary commands remotely.

Q: Is there a workaround for CVE-2025-30264?

No official workaround is provided for CVE-2025-30264; updating the software is the recommended action.

Published Aug 29, 2025

Updated

A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to execute arbitrary commands.

We have already fixed the vulnerability in the following versions: QTS 5.2.5.3145 build 20250526 and later QuTS hero h5.2.5.3138 build 20250519 and later

Affected Software

28 affected components

QNAP QTS<5.2.5.3145

QNAP QuTS hero<5.2.5.3138

QNAP QTS=5.2.0.2737-build_20240417

QNAP QTS=5.2.0.2744-build_20240424

QNAP QTS=5.2.0.2782-build_20240601

QNAP QTS=5.2.0.2802-build_20240620

QNAP QTS=5.2.0.2823-build_20240711

QNAP QTS=5.2.0.2851-build_20240808

QNAP QTS=5.2.0.2860-build_20240817

QNAP QTS=5.2.1.2930-build_20241025

QNAP QTS=5.2.2.2950-build_20241114

QNAP QTS=5.2.3.3006-build_20250108

QNAP QTS=5.2.4.3070-build_20250312

QNAP QTS=5.2.4.3079-build_20250321

QNAP QTS=5.2.4.3092-build_20250403

QNAP QuTS hero=h5.2.0.2737-build_20240417

QNAP QuTS hero=h5.2.0.2782-build_20240601

QNAP QuTS hero=h5.2.0.2789-build_20240607

QNAP QuTS hero=h5.2.0.2802-build_20240620

QNAP QuTS hero=h5.2.0.2823-build_20240711

QNAP QuTS hero=h5.2.0.2851-build_20240808

QNAP QuTS hero=h5.2.0.2860-build_20240817

QNAP QuTS hero=h5.2.1.2929-build_20241025

QNAP QuTS hero=h5.2.1.2940-build_20241105

QNAP QuTS hero=h5.2.2.2952-build_20241116

QNAP QuTS hero=h5.2.3.3006-build_20250108

QNAP QuTS hero=h5.2.4.3070-build_20250312

QNAP QuTS hero=h5.2.4.3079-build_20250321

Remediation

Information

We have already fixed the vulnerability in the following versions: QTS 5.2.5.3145 build 20250526 and later QuTS hero h5.2.5.3138 build 20250519 and later

Event History

Aug 29, 2025

CVE Published

via MITRE·05:15 PM

Data Sourced

via MITRE·05:15 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·06:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-30264?

CVE-2025-30264 is classified as a critical command injection vulnerability.

How do I fix CVE-2025-30264?