CVE-2025-47212: QTS, QuTS hero

Q: What is the severity of CVE-2025-47212?

CVE-2025-47212 has been classified as a high severity command injection vulnerability.

Q: How do I fix CVE-2025-47212?

To fix CVE-2025-47212, upgrade your QNAP operating system to the latest version beyond 5.2.6.3195.

Q: Which QNAP products are affected by CVE-2025-47212?

CVE-2025-47212 affects QNAP QTS and QNAP QuTS hero operating systems up to version 5.2.6.3195.

Q: What actions can an attacker perform using CVE-2025-47212?

An attacker with an administrator account can exploit CVE-2025-47212 to execute arbitrary commands on the affected system.

Q: Is there a workaround for CVE-2025-47212 before applying the fix?

Currently, there are no recommended workarounds for CVE-2025-47212; applying the patch is essential.

Published Oct 3, 2025

Updated

A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands.

We have already fixed the vulnerability in the following versions: QTS 5.2.6.3195 build 20250715 and later QuTS hero h5.2.6.3195 build 20250715 and later

Affected Software

30 affected components

QNAP QTS<5.2.6.3195

QNAP QuTS hero<5.2.6.3195

QNAP QTS=5.2.0.2737-build_20240417

QNAP QTS=5.2.0.2744-build_20240424

QNAP QTS=5.2.0.2782-build_20240601

QNAP QTS=5.2.0.2802-build_20240620

QNAP QTS=5.2.0.2823-build_20240711

QNAP QTS=5.2.0.2851-build_20240808

QNAP QTS=5.2.0.2860-build_20240817

QNAP QTS=5.2.1.2930-build_20241025

QNAP QTS=5.2.2.2950-build_20241114

QNAP QTS=5.2.3.3006-build_20250108

QNAP QTS=5.2.4.3070-build_20250312

QNAP QTS=5.2.4.3079-build_20250321

QNAP QTS=5.2.4.3092-build_20250403

QNAP QTS=5.2.5.3145-build_20250526

QNAP QuTS hero=h5.2.0.2737-build_20240417

QNAP QuTS hero=h5.2.0.2782-build_20240601

QNAP QuTS hero=h5.2.0.2789-build_20240607

QNAP QuTS hero=h5.2.0.2802-build_20240620

QNAP QuTS hero=h5.2.0.2823-build_20240711

QNAP QuTS hero=h5.2.0.2851-build_20240808

QNAP QuTS hero=h5.2.0.2860-build_20240817

QNAP QuTS hero=h5.2.1.2929-build_20241025

QNAP QuTS hero=h5.2.1.2940-build_20241105

QNAP QuTS hero=h5.2.2.2952-build_20241116

QNAP QuTS hero=h5.2.3.3006-build_20250108

QNAP QuTS hero=h5.2.4.3070-build_20250312

QNAP QuTS hero=h5.2.4.3079-build_20250321

QNAP QuTS hero=h5.2.5.3138-build_20250519

Remediation

Information

We have already fixed the vulnerability in the following versions: QTS 5.2.6.3195 build 20250715 and later QuTS hero h5.2.6.3195 build 20250715 and later

Event History

Oct 3, 2025

CVE Published

via MITRE·06:10 PM

Data Sourced

via MITRE·06:10 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·07:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-47212?

CVE-2025-47212 has been classified as a high severity command injection vulnerability.

How do I fix CVE-2025-47212?