← Back to CVE Explorer

CVE-2025-52857

Full vulnerability record from the local CVENow database.

Description

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QTS 5.2.6.3195 build 20250715 and later QuTS hero h5.2.6.3195 build 20250715 and later

Severity
MEDIUM
CVSS score
5.1 (v4.0)
Vulnerability status
Analyzed
Source identifier
[email protected]
Published
2025-10-03 19:15:47.467000
Last modified
2026-10-18 21:10:00.120000
View original CVE JSON 
{
  "id": "CVE-2025-52857",
  "sourceIdentifier": "[email protected]",
  "published": "2025-10-03T19:15:47.467",
  "lastModified": "2026-10-18T21:10:00.120",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.\n\nWe have already fixed the vulnerability in the following versions:\nQTS 5.2.6.3195 build 20250715 and later\nQuTS hero h5.2.6.3195 build 20250715 and later"
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de desreferencia de puntero NULL ha sido reportada que afecta a varias versiones del sistema operativo QNAP. Si un atacante remoto obtiene una cuenta de administrador, puede entonces explotar la vulnerabilidad para lanzar un ataque de denegación de servicio (DoS).\n\nYa hemos corregido la vulnerabilidad en las siguientes versiones:\nQTS 5.2.6.3195 build 20250715 y posteriores\nQuTS hero h5.2.6.3195 build 20250715 y posteriores"
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "QNAP Systems Inc.",
          "product": "QTS",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "5.2.x",
              "lessThan": "5.2.6.3195 build 20250715",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "QNAP Systems Inc.",
          "product": "QuTS hero",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "h5.2.x",
              "lessThan": "h5.2.6.3195 build 20250715",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 5.1,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnAvailabilityImpact": "LOW",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 4.9,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-10-03T19:04:29.782373Z",
          "id": "CVE-2025-52857",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-476"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2737:build_20240417:*:*:*:*:*:*",
              "matchCriteriaId": "F4026A4B-7AB4-48EA-971D-88DFDD3F01A7"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2744:build_20240424:*:*:*:*:*:*",
              "matchCriteriaId": "1F3F99BB-0D68-4D74-92C8-59E24F96C50D"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2782:build_20240601:*:*:*:*:*:*",
              "matchCriteriaId": "1DE63B4D-8E84-41D3-B1F3-04AE6040242B"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2802:build_20240620:*:*:*:*:*:*",
              "matchCriteriaId": "75746563-C648-4E55-9126-703F915F8B8A"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2823:build_20240711:*:*:*:*:*:*",
              "matchCriteriaId": "AF6BA027-A635-4E90-80C8-130B10AB3D23"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2851:build_20240808:*:*:*:*:*:*",
              "matchCriteriaId": "5406F242-A215-4B07-809F-7A7CE55ACE71"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2860:build_20240817:*:*:*:*:*:*",
              "matchCriteriaId": "FA17778E-B3B1-44DD-B4E9-5AD25A3E804C"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:qnap:qts:5.2.1.2930:build_20241025:*:*:*:*:*:*",
              "matchCriteriaId": "E3FC6646-2247-4ED9-9643-CD376674E2E7"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:qnap:qts:5.2.2.2950:build_20241114:*:*:*:*:*:*",
              "matchCriteriaId": "62170342-067D-442C-88FB-64A4BEA8AFE4"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:qnap:qts:5.2.3.3006:build_20250108:*:*:*:*:*:*",
              "matchCriteriaId": "82464467-E1E6-47E1-BDE5-DDFA52994A47"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:qnap:qts:5.2.4.3070:build_20250312:*:*:*:*:*:*",
              "matchCriteriaId": "75AE902C-0516-4341-9BF0-21D8803E091C"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:qnap:qts:5.2.4.3079:build_20250321:*:*:*:*:*:*",
              "matchCriteriaId": "5B005D70-8C91-48D4-B09A-9EBE2E9E5090"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:qnap:qts:5.2.4.3092:build_20250403:*:*:*:*:*:*",
              "matchCriteriaId": "82FE5F89-A0E1-4D1B-A363-0A0D4141F502"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:qnap:qts:5.2.5.3145:build_20250526:*:*:*:*:*:*",
              "matchCriteriaId": "B21A9EE0-88D5-42D9-BA21-D55518FCC6E4"
            }
          ]
        }
      ]
    },
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2737:build_20240417:*:*:*:*:*:*",
              "matchCriteriaId": "CDCBB36A-CB91-4BA3-A6ED-952E6A4A0481"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2782:build_20240601:*:*:*:*:*:*",
              "matchCriteriaId": "240BCFF1-CCCB-4C07-8E2C-7F43F68407FC"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2789:build_20240607:*:*:*:*:*:*",
              "matchCriteriaId": "D3AF7276-77E0-474A-B10F-AC15BC5FCF00"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2802:build_20240620:*:*:*:*:*:*",
              "matchCriteriaId": "5FA8C3EC-B6C0-44A8-BC91-18E3E90C63AB"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2823:build_20240711:*:*:*:*:*:*",
              "matchCriteriaId": "889336D2-D9F7-4CC0-A22F-B837B5E77751"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2851:build_20240808:*:*:*:*:*:*",
              "matchCriteriaId": "98F72EB9-0EE3-416A-B9BB-2512F5203A5A"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2860:build_20240817:*:*:*:*:*:*",
              "matchCriteriaId": "9110382F-57C2-4C2E-82D1-3246C882B2C3"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.1.2929:build_20241025:*:*:*:*:*:*",
              "matchCriteriaId": "DB92EFD7-47DD-4AAC-97BD-A2D4918FF4ED"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.1.2940:build_20241105:*:*:*:*:*:*",
              "matchCriteriaId": "78E38E23-1AD0-49E1-89FA-73DC2F496137"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.2.2952:build_20241116:*:*:*:*:*:*",
              "matchCriteriaId": "F2F302B6-26CC-4044-B480-4EBDBB90797F"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.3.3006:build_20250108:*:*:*:*:*:*",
              "matchCriteriaId": "BF0093B6-8D38-4D1E-AD71-79299123C2B1"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.4.3070:build_20250312:*:*:*:*:*:*",
              "matchCriteriaId": "48A3CDAA-B0C6-4280-B1AC-DDD027F9D632"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.4.3079:build_20250321:*:*:*:*:*:*",
              "matchCriteriaId": "1807DE4F-CDF3-4E3B-ADC1-9535EF1D60FE"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.5.3138:build_20250519:*:*:*:*:*:*",
              "matchCriteriaId": "68FF7342-A0AF-4E75-9CD6-D584B450B8AB"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.qnap.com/en/security-advisory/qsa-25-36",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}