ZDI-CAN-28428: ZDI-26-243: (Pwn2Own) QNAP TS-453E write_file_to_svr External Control of File Path Remote Code Execution Vulnerability

Published Mar 30, 2026

Updated

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of QNAP TS-453E devices. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The ZDI has assigned a CVSS rating of 6.8. The following CVEs are assigned: CVE-2025-62842.

Affected Software

1 affected component

QNAP TS-453E

Event History

Mar 30, 2026

Advisory Published

via ZDI·05:00 AM

Data Sourced

via ZDI·05:00 AM

Description

Frequently Asked Questions

What is the severity of ZDI-CAN-28428?

The severity of ZDI-CAN-28428 is classified as critical due to its potential for remote code execution.

How do I fix ZDI-CAN-28428?

To fix ZDI-CAN-28428, update your QNAP TS-453E device to the latest firmware version provided by QNAP.

What type of vulnerability is ZDI-CAN-28428?

ZDI-CAN-28428 is classified as an External Control of File Path Remote Code Execution vulnerability.

Who is affected by ZDI-CAN-28428?

ZDI-CAN-28428 affects users of QNAP TS-453E devices that have not been updated against this vulnerability.

Can ZDI-CAN-28428 be exploited without authentication?

Exploitation of ZDI-CAN-28428 does require authentication to the affected QNAP TS-453E device.