ZDI-26-199: (Pwn2Own) QNAP TS-453E conn_log_tool Format String Remote Code Execution Vulnerability
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of QNAP TS-453E devices. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The ZDI has assigned a CVSS rating of 5.5. The following CVEs are assigned: CVE-2025-62848.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-26-199?
The severity of ZDI-26-199 is categorized as high due to its potential for remote code execution.
How do I fix ZDI-26-199?
To fix ZDI-26-199, update your QNAP TS-453E device to the latest firmware version provided by QNAP.
What types of attacks are possible with ZDI-26-199?
ZDI-26-199 allows network-adjacent attackers to execute arbitrary code on vulnerable QNAP TS-453E devices.
Is authentication required to exploit ZDI-26-199?
Yes, authentication is required to exploit the ZDI-26-199 vulnerability.
Which devices are affected by ZDI-26-199?
ZDI-26-199 specifically affects QNAP TS-453E devices.