ZDI-26-243: (Pwn2Own) QNAP TS-453E write_file_to_svr External Control of File Path Remote Code Execution Vulnerability
Published Mar 30, 2026
·Updated
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of QNAP TS-453E devices. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The ZDI has assigned a CVSS rating of 6.8. The following CVEs are assigned: CVE-2025-62842.
Affected Software
1 affected component
QNAP TS-453E
Event History
Mar 30, 2026
Advisory Published
via ZDI·05:00 AM
Data Sourced
via ZDI·05:00 AM
Description
Frequently Asked Questions
1
What is the severity of ZDI-26-243?
The severity of ZDI-26-243 is high due to its potential for remote code execution.
2
How do I fix ZDI-26-243?
To fix ZDI-26-243, apply the latest firmware update provided by QNAP for the TS-453E device.
3
What type of attacks can exploit ZDI-26-243?
ZDI-26-243 can be exploited by network-adjacent attackers to execute arbitrary code.
4
Is authentication required to exploit ZDI-26-243?
Yes, authentication is required to exploit ZDI-26-243 on affected QNAP TS-453E devices.
5
What devices are affected by ZDI-26-243?
ZDI-26-243 specifically affects the QNAP TS-453E devices.