CVE-2025-30274: QTS, QuTS hero

Q: What is the severity of CVE-2025-30274?

CVE-2025-30274 is a critical vulnerability that can lead to a denial-of-service (DoS) attack.

Q: How do I fix CVE-2025-30274?

To fix CVE-2025-30274, update your QNAP operating system to QTS version 5.2.5.3145 or higher, or QuTS hero version 5.2.5.3138 or higher.

Q: Which QNAP products are affected by CVE-2025-30274?

CVE-2025-30274 affects QNAP QTS versions up to 5.2.5.3145 and QuTS hero versions up to 5.2.5.3138.

Q: What type of vulnerability is CVE-2025-30274?

CVE-2025-30274 is a NULL pointer dereference vulnerability.

Q: Can CVE-2025-30274 be exploited remotely?

Yes, CVE-2025-30274 can potentially be exploited remotely to perform a denial-of-service attack.

Published Aug 29, 2025

Updated

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following versions: QTS 5.2.5.3145 build 20250526 and later QuTS hero h5.2.5.3138 build 20250519 and later

Affected Software

28 affected components

QNAP QTS<5.2.5.3145

QNAP QuTS hero<5.2.5.3138

QNAP QTS=5.2.0.2737-build_20240417

QNAP QTS=5.2.0.2744-build_20240424

QNAP QTS=5.2.0.2782-build_20240601

QNAP QTS=5.2.0.2802-build_20240620

QNAP QTS=5.2.0.2823-build_20240711

QNAP QTS=5.2.0.2851-build_20240808

QNAP QTS=5.2.0.2860-build_20240817

QNAP QTS=5.2.1.2930-build_20241025

QNAP QTS=5.2.2.2950-build_20241114

QNAP QTS=5.2.3.3006-build_20250108

QNAP QTS=5.2.4.3070-build_20250312

QNAP QTS=5.2.4.3079-build_20250321

QNAP QTS=5.2.4.3092-build_20250403

QNAP QuTS hero=h5.2.0.2737-build_20240417

QNAP QuTS hero=h5.2.0.2782-build_20240601

QNAP QuTS hero=h5.2.0.2789-build_20240607

QNAP QuTS hero=h5.2.0.2802-build_20240620

QNAP QuTS hero=h5.2.0.2823-build_20240711

QNAP QuTS hero=h5.2.0.2851-build_20240808

QNAP QuTS hero=h5.2.0.2860-build_20240817

QNAP QuTS hero=h5.2.1.2929-build_20241025

QNAP QuTS hero=h5.2.1.2940-build_20241105

QNAP QuTS hero=h5.2.2.2952-build_20241116

QNAP QuTS hero=h5.2.3.3006-build_20250108

QNAP QuTS hero=h5.2.4.3070-build_20250312

QNAP QuTS hero=h5.2.4.3079-build_20250321

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade QNAP QTS to a version that resolves this vulnerability.
Fixed in 5.2.5.3145
Upgrade
Upgrade QNAP QuTS hero to a version that resolves this vulnerability.
Fixed in h5.2.5.3138

Event History

Aug 29, 2025

CVE Published

via MITRE·05:16 PM

Data Sourced

via MITRE·05:16 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·06:15 PM

DescriptionSeverityWeaknessAffected Software

Feb 4, 58705

Event

via NVD·09:14 AM

Frequently Asked Questions

What is the severity of CVE-2025-30274?

CVE-2025-30274 is a critical vulnerability that can lead to a denial-of-service (DoS) attack.

How do I fix CVE-2025-30274?