CVE-2025-66281: QTS, QuTS hero
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to launch a denial-of-service (DoS) attack.
We have already fixed the vulnerability in the following versions: QTS 5.2.9.3410 build 20260214 and later QuTS hero h5.2.9.3410 build 20260214 and later QuTS hero h5.3.4.3500 build 20260520 and later QuTS hero h6.0.0.3397 build 20260206 and later
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
QTSto a version that resolves this vulnerability.Fixed in 5.2.9.3410 build 20260214 - Upgrade
Upgrade
QuTS heroto a version that resolves this vulnerability.Fixed in h5.2.9.3410 build 20260214 - Upgrade
Upgrade
QuTS heroto a version that resolves this vulnerability.Fixed in h5.3.4.3500 build 20260520 - Upgrade
Upgrade
QuTS heroto a version that resolves this vulnerability.Fixed in h6.0.0.3397 build 20260206
Event History
Frequently Asked Questions
What is the severity of CVE-2025-66281?
CVE-2025-66281 has a medium severity rating of 6.9 according to the CVSS.
What is CVE-2025-66281?
CVE-2025-66281 is a NULL pointer dereference vulnerability affecting several versions of QNAP operating systems.
How can CVE-2025-66281 be exploited?
Remote attackers can exploit CVE-2025-66281 to launch a denial-of-service (DoS) attack.
How do I fix CVE-2025-66281?
To fix CVE-2025-66281, update to QTS version 5.2.9.3410 build 20260214 or later, or the respective QuTS hero versions.
Which versions of QNAP software are affected by CVE-2025-66281?
CVS-2025-66281 affects several QNAP operating system versions prior to the specified fixed builds.