← Back to CVE Explorer

CVE-2025-62848

Full vulnerability record from the local CVENow database.

Description

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QTS 5.2.7.3297 build 20251024 and later QuTS hero h5.2.7.3297 build 20251024 and later QuTS hero h5.3.1.3292 build 20251024 and later

Severity
HIGH
CVSS score
8.1 (v4.0)
Vulnerability status
Analyzed
Source identifier
[email protected]
Published
2025-12-16 03:15:58.350000
Last modified
2026-11-03 22:17:42.897000
View original CVE JSON 
{
  "id": "CVE-2025-62848",
  "sourceIdentifier": "[email protected]",
  "published": "2025-12-16T03:15:58.350",
  "lastModified": "2026-11-03T22:17:42.897",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to launch a denial-of-service (DoS) attack.\n\nWe have already fixed the vulnerability in the following versions:\nQTS 5.2.7.3297 build 20251024 and later\nQuTS hero h5.2.7.3297 build 20251024 and later\nQuTS hero h5.3.1.3292 build 20251024 and later"
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de desreferencia de puntero NULL ha sido reportada que afecta a varias versiones del sistema operativo QNAP. Los atacantes remotos pueden entonces explotar la vulnerabilidad para lanzar un ataque de denegación de servicio (DoS).\n\nYa hemos corregido la vulnerabilidad en las siguientes versiones:\nQTS 5.2.7.3297 build 20251024 y posteriores\nQuTS hero h5.2.7.3297 build 20251024 y posteriores\nQuTS hero h5.3.1.3292 build 20251024 y posteriores"
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "QNAP Systems Inc.",
          "product": "QTS",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "5.2.x",
              "lessThan": "5.2.7.3297 build 20251024",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "QNAP Systems Inc.",
          "product": "QuTS hero",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "h5.2.x",
              "lessThan": "h5.2.7.3297 build 20251024",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "h5.3.x",
              "lessThan": "h5.3.1.3292 build 20251024",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnAvailabilityImpact": "HIGH",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "UNREPORTED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-03-18T03:55:47.745887Z",
          "id": "CVE-2025-62848",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-476"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2737:build_20240417:*:*:*:*:*:*",
              "matchCriteriaId": "F4026A4B-7AB4-48EA-971D-88DFDD3F01A7"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2744:build_20240424:*:*:*:*:*:*",
              "matchCriteriaId": "1F3F99BB-0D68-4D74-92C8-59E24F96C50D"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2782:build_20240601:*:*:*:*:*:*",
              "matchCriteriaId": "1DE63B4D-8E84-41D3-B1F3-04AE6040242B"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2802:build_20240620:*:*:*:*:*:*",
              "matchCriteriaId": "75746563-C648-4E55-9126-703F915F8B8A"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2823:build_20240711:*:*:*:*:*:*",
              "matchCriteriaId": "AF6BA027-A635-4E90-80C8-130B10AB3D23"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2851:build_20240808:*:*:*:*:*:*",
              "matchCriteriaId": "5406F242-A215-4B07-809F-7A7CE55ACE71"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2860:build_20240817:*:*:*:*:*:*",
              "matchCriteriaId": "FA17778E-B3B1-44DD-B4E9-5AD25A3E804C"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:qnap:qts:5.2.1.2930:build_20241025:*:*:*:*:*:*",
              "matchCriteriaId": "E3FC6646-2247-4ED9-9643-CD376674E2E7"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:qnap:qts:5.2.2.2950:build_20241114:*:*:*:*:*:*",
              "matchCriteriaId": "62170342-067D-442C-88FB-64A4BEA8AFE4"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:qnap:qts:5.2.3.3006:build_20250108:*:*:*:*:*:*",
              "matchCriteriaId": "82464467-E1E6-47E1-BDE5-DDFA52994A47"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:qnap:qts:5.2.4.3070:build_20250312:*:*:*:*:*:*",
              "matchCriteriaId": "75AE902C-0516-4341-9BF0-21D8803E091C"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:qnap:qts:5.2.4.3079:build_20250321:*:*:*:*:*:*",
              "matchCriteriaId": "5B005D70-8C91-48D4-B09A-9EBE2E9E5090"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:qnap:qts:5.2.4.3092:build_20250403:*:*:*:*:*:*",
              "matchCriteriaId": "82FE5F89-A0E1-4D1B-A363-0A0D4141F502"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:qnap:qts:5.2.5.3145:build_20250526:*:*:*:*:*:*",
              "matchCriteriaId": "B21A9EE0-88D5-42D9-BA21-D55518FCC6E4"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:qnap:qts:5.2.6.3195:build_20250715:*:*:*:*:*:*",
              "matchCriteriaId": "3B575CF2-21F3-4435-B6B4-61D79B34429C"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:qnap:qts:5.2.6.3229:build_20250818:*:*:*:*:*:*",
              "matchCriteriaId": "E2EBD305-91E3-4BCC-835B-4878DF4DA3B8"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:qnap:qts:5.2.7.3256:build_20250913:*:*:*:*:*:*",
              "matchCriteriaId": "554CB021-1477-4E63-8EBA-74056B4D8DA7"
            }
          ]
        }
      ]
    },
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2737:build_20240417:*:*:*:*:*:*",
              "matchCriteriaId": "CDCBB36A-CB91-4BA3-A6ED-952E6A4A0481"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2782:build_20240601:*:*:*:*:*:*",
              "matchCriteriaId": "240BCFF1-CCCB-4C07-8E2C-7F43F68407FC"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2789:build_20240607:*:*:*:*:*:*",
              "matchCriteriaId": "D3AF7276-77E0-474A-B10F-AC15BC5FCF00"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2802:build_20240620:*:*:*:*:*:*",
              "matchCriteriaId": "5FA8C3EC-B6C0-44A8-BC91-18E3E90C63AB"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2823:build_20240711:*:*:*:*:*:*",
              "matchCriteriaId": "889336D2-D9F7-4CC0-A22F-B837B5E77751"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2851:build_20240808:*:*:*:*:*:*",
              "matchCriteriaId": "98F72EB9-0EE3-416A-B9BB-2512F5203A5A"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2860:build_20240817:*:*:*:*:*:*",
              "matchCriteriaId": "9110382F-57C2-4C2E-82D1-3246C882B2C3"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.1.2929:build_20241025:*:*:*:*:*:*",
              "matchCriteriaId": "DB92EFD7-47DD-4AAC-97BD-A2D4918FF4ED"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.1.2940:build_20241105:*:*:*:*:*:*",
              "matchCriteriaId": "78E38E23-1AD0-49E1-89FA-73DC2F496137"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.2.2952:build_20241116:*:*:*:*:*:*",
              "matchCriteriaId": "F2F302B6-26CC-4044-B480-4EBDBB90797F"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.3.3006:build_20250108:*:*:*:*:*:*",
              "matchCriteriaId": "BF0093B6-8D38-4D1E-AD71-79299123C2B1"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.4.3070:build_20250312:*:*:*:*:*:*",
              "matchCriteriaId": "48A3CDAA-B0C6-4280-B1AC-DDD027F9D632"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.4.3079:build_20250321:*:*:*:*:*:*",
              "matchCriteriaId": "1807DE4F-CDF3-4E3B-ADC1-9535EF1D60FE"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.5.3138:build_20250519:*:*:*:*:*:*",
              "matchCriteriaId": "68FF7342-A0AF-4E75-9CD6-D584B450B8AB"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.6.3195:build_20250715:*:*:*:*:*:*",
              "matchCriteriaId": "A8E84E3D-943C-4DF5-86D3-DCAC3C034B81"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.7.3256:build_20250913:*:*:*:*:*:*",
              "matchCriteriaId": "17720E05-1BBF-4605-A777-FA4059B3C2DC"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:qnap:quts_hero:h5.3.0.3115:build_20250430:*:*:*:*:*:*",
              "matchCriteriaId": "4175C7F7-E946-41C6-8863-E23233B91A2B"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:qnap:quts_hero:h5.3.0.3145:build_20250530:*:*:*:*:*:*",
              "matchCriteriaId": "DE16C73E-9291-44FD-A9CB-B7C127E67A6F"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:qnap:quts_hero:h5.3.0.3192:build_20250716:*:*:*:*:*:*",
              "matchCriteriaId": "ED4023E4-6C28-413A-B7B1-6CEEBC48A1C0"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:qnap:quts_hero:h5.3.1.3250:build_20250912:*:*:*:*:*:*",
              "matchCriteriaId": "0A94FE59-675E-4FF1-B971-F5A0A7B98EA7"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.qnap.com/en/security-advisory/qsa-25-45",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}