CVE-2025-9110: QTS, QuTS hero

Q: What is the severity of CVE-2025-9110?

CVE-2025-9110 is rated as a high severity vulnerability due to the potential exposure of sensitive system information.

Q: How do I fix CVE-2025-9110?

To fix CVE-2025-9110, update your QNAP QTS or QuTS hero operating system to the latest version as specified in security advisories.

Q: What versions of QNAP products are affected by CVE-2025-9110?

CVE-2025-9110 affects QNAP QTS versions prior to 5.2.8.3332 and QuTS hero versions prior to h5.2.8.3321 and h5.3.1.3250.

Q: Can CVE-2025-9110 be exploited remotely?

Yes, CVE-2025-9110 can be exploited remotely by attackers to read sensitive application data.

Q: Is there a public proof of concept for CVE-2025-9110?

Currently, there is no public proof of concept for CVE-2025-9110, but its exploitation remains a critical concern.

Published Jan 2, 2026

Updated

An exposure of sensitive system information to an unauthorized control sphere vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to read application data.

We have already fixed the vulnerability in the following versions: QTS 5.2.8.3332 build 20251128 and later QuTS hero h5.2.8.3321 build 20251117 and later QuTS hero h5.3.1.3250 build 20250912 and later

Affected Software

40 affected components

QNAP QTS<5.2.8.3332

QNAP QuTS hero<h5.2.8.3321, <h5.3.1.3250

QNAP QTS=5.2.0.2737-build_20240417

QNAP QTS=5.2.0.2744-build_20240424

QNAP QTS=5.2.0.2782-build_20240601

QNAP QTS=5.2.0.2802-build_20240620

QNAP QTS=5.2.0.2823-build_20240711

QNAP QTS=5.2.0.2851-build_20240808

QNAP QTS=5.2.0.2860-build_20240817

QNAP QTS=5.2.1.2930-build_20241025

QNAP QTS=5.2.2.2950-build_20241114

QNAP QTS=5.2.3.3006-build_20250108

QNAP QTS=5.2.4.3070-build_20250312

QNAP QTS=5.2.4.3079-build_20250321

QNAP QTS=5.2.4.3092-build_20250403

QNAP QTS=5.2.5.3145-build_20250526

QNAP QTS=5.2.6.3195-build_20250715

QNAP QTS=5.2.6.3229-build_20250818

QNAP QTS=5.2.7.3256-build_20250913

QNAP QTS=5.2.7.3297-build_20251024

QNAP QuTS hero=h5.2.0.2737-build_20240417

QNAP QuTS hero=h5.2.0.2782-build_20240601

QNAP QuTS hero=h5.2.0.2789-build_20240607

QNAP QuTS hero=h5.2.0.2802-build_20240620

QNAP QuTS hero=h5.2.0.2823-build_20240711

QNAP QuTS hero=h5.2.0.2851-build_20240808

QNAP QuTS hero=h5.2.0.2860-build_20240817

QNAP QuTS hero=h5.2.1.2929-build_20241025

QNAP QuTS hero=h5.2.1.2940-build_20241105

QNAP QuTS hero=h5.2.2.2952-build_20241116

QNAP QuTS hero=h5.2.3.3006-build_20250108

QNAP QuTS hero=h5.2.4.3070-build_20250312

QNAP QuTS hero=h5.2.4.3079-build_20250321

QNAP QuTS hero=h5.2.5.3138-build_20250519

QNAP QuTS hero=h5.2.6.3195-build_20250715

QNAP QuTS hero=h5.2.7.3256-build_20250913

QNAP QuTS hero=h5.2.7.3297-build_20251024

QNAP QuTS hero=h5.3.0.3115-build_20250430

QNAP QuTS hero=h5.3.0.3145-build_20250530

QNAP QuTS hero=h5.3.0.3192-build_20250716

Remediation

Information

Event History

Jan 2, 2026

CVE Published

via MITRE·03:17 PM

Data Sourced

via MITRE·03:17 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·04:17 PM

DescriptionSeverityWeaknessAffected Software

Feb 28, 57989

Event

via FIRST·05:12 AM

Frequently Asked Questions

What is the severity of CVE-2025-9110?

CVE-2025-9110 is rated as a high severity vulnerability due to the potential exposure of sensitive system information.

How do I fix CVE-2025-9110?