ZDI-CAN-28426: ZDI-26-242: (Pwn2Own) QNAP TS-453E server_handlers.pyc rr2s.kwargs Error Message Information Disclosure Vulnerability
This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of QNAP TS-453E devices. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The ZDI has assigned a CVSS rating of 3.5. The following CVEs are assigned: CVE-2025-62840.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-CAN-28426?
The severity of ZDI-CAN-28426 is classified based on its potential to disclose sensitive information to network-adjacent attackers.
How do I fix ZDI-CAN-28426?
To fix ZDI-CAN-28426, ensure that you update your QNAP TS-453E device to the latest firmware provided by the vendor.
Who is affected by ZDI-CAN-28426?
Users of QNAP TS-453E devices with specific configurations are affected by ZDI-CAN-28426.
What kind of data is exposed by ZDI-CAN-28426?
ZDI-CAN-28426 can lead to the disclosure of sensitive information stored in QNAP TS-453E devices.
Is authentication required to exploit ZDI-CAN-28426?
Yes, authentication is required for an attacker to exploit ZDI-CAN-28426.