CVE-2025-62847: QTS, QuTS hero

Q: What is the vulnerability CVE-2025-62847?

CVE-2025-62847 is an improper neutralization of argument delimiters in a command vulnerability affecting several QNAP operating system versions.

Q: What are the potential consequences of CVE-2025-62847?

Remote attackers can exploit CVE-2025-62847 to alter execution logic on affected systems.

Q: How do I remediate CVE-2025-62847?

To fix CVE-2025-62847, update your QNAP devices to the latest firmware versions that have addressed this vulnerability.

Q: Which QNAP products are affected by CVE-2025-62847?

CVE-2025-62847 affects QNAP QTS up to version 5.2.7.3297 and QNAP QuTS hero up to versions h5.2.7.3297 and h5.3.1.3292.

Q: Is there a patch available for CVE-2025-62847?

Yes, QNAP has released patches addressing CVE-2025-62847 for the affected operating system versions.

Published Dec 16, 2025

Updated

An improper neutralization of argument delimiters in a command vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to alter execution logic.

We have already fixed the vulnerability in the following versions: QTS 5.2.7.3297 build 20251024 and later QuTS hero h5.2.7.3297 build 20251024 and later QuTS hero h5.3.1.3292 build 20251024 and later

Affected Software

40 affected components

QNAP QTS<5.2.7.3297

QNAP QuTS hero<h5.2.7.3297

QNAP QuTS hero<h5.3.1.3292

QNAP QTS=5.2.0.2737-build_20240417

QNAP QTS=5.2.0.2744-build_20240424

QNAP QTS=5.2.0.2782-build_20240601

QNAP QTS=5.2.0.2802-build_20240620

QNAP QTS=5.2.0.2823-build_20240711

QNAP QTS=5.2.0.2851-build_20240808

QNAP QTS=5.2.0.2860-build_20240817

QNAP QTS=5.2.1.2930-build_20241025

QNAP QTS=5.2.2.2950-build_20241114

QNAP QTS=5.2.3.3006-build_20250108

QNAP QTS=5.2.4.3070-build_20250312

QNAP QTS=5.2.4.3079-build_20250321

QNAP QTS=5.2.4.3092-build_20250403

QNAP QTS=5.2.5.3145-build_20250526

QNAP QTS=5.2.6.3195-build_20250715

QNAP QTS=5.2.6.3229-build_20250818

QNAP QTS=5.2.7.3256-build_20250913

QNAP QuTS hero=h5.2.0.2737-build_20240417

QNAP QuTS hero=h5.2.0.2782-build_20240601

QNAP QuTS hero=h5.2.0.2789-build_20240607

QNAP QuTS hero=h5.2.0.2802-build_20240620

QNAP QuTS hero=h5.2.0.2823-build_20240711

QNAP QuTS hero=h5.2.0.2851-build_20240808

QNAP QuTS hero=h5.2.0.2860-build_20240817

QNAP QuTS hero=h5.2.1.2929-build_20241025

QNAP QuTS hero=h5.2.1.2940-build_20241105

QNAP QuTS hero=h5.2.2.2952-build_20241116

QNAP QuTS hero=h5.2.3.3006-build_20250108

QNAP QuTS hero=h5.2.4.3070-build_20250312

QNAP QuTS hero=h5.2.4.3079-build_20250321

QNAP QuTS hero=h5.2.5.3138-build_20250519

QNAP QuTS hero=h5.2.6.3195-build_20250715

QNAP QuTS hero=h5.2.7.3256-build_20250913

QNAP QuTS hero=h5.3.0.3115-build_20250430

QNAP QuTS hero=h5.3.0.3145-build_20250530

QNAP QuTS hero=h5.3.0.3192-build_20250716

QNAP QuTS hero=h5.3.1.3250-build_20250912

Remediation

Information

Event History

Nov 7, 2025

News Published

via BleepingComputer·06:24 PM

News Published

via BleepingComputer·06:25 PM

Dec 16, 2025

CVE Published

via MITRE·02:25 AM

Data Sourced

via MITRE·02:25 AM

RemedyDescriptionWeakness

Data Sourced

via NVD·03:15 AM

DescriptionSeverityWeaknessAffected Software

Jun 14, 58182

Event

via NVD·01:21 AM

Frequently Asked Questions

What is the vulnerability CVE-2025-62847?

CVE-2025-62847 is an improper neutralization of argument delimiters in a command vulnerability affecting several QNAP operating system versions.

What are the potential consequences of CVE-2025-62847?