Ce mail provient de l'extérieur, restons vigilants

=====================================================================

                            CERT-Renater

                Note d'Information No. 2025/VULN568
_____________________________________________________________________

DATE                : 02/09/2025

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running QTS versions prior to
                          5.2.5.3145 build 20250526,
             QuTS hero versions prior to h5.2.5.3138 build 20250519.

=====================================================================
https://www.qnap.com/en/security-advisory/qsa-25-21
_____________________________________________________________________

Security ID : QSA-25-21
Multiple Vulnerabilities in QTS and QuTS hero

    Release date : August 29, 2025

    CVE identifier : CVE-2025-29882 | CVE-2025-30264 | CVE-2025-30265
| CVE-2025-30267 | CVE-2025-30268 | CVE-2025-30270 | CVE-2025-30271
| CVE-2025-30272 | CVE-2025-30273 | CVE-2025-30274 | CVE-2025-33032

    Affected products: QTS 5.2.x, QuTS hero h5.2.x

Severity
Important

Status
Resolved


Summary

Multiple vulnerabilities have been reported to affect certain QNAP
operating system versions:

    CVE-2025-29882: If a remote attacker gains access to a user
account, they can then exploit the NULL pointer dereference
vulnerability to launch a denial-of-service (DoS) attack.

    CVE-2025-30264: If a remote attacker gains access to a user
account, they can then exploit the command injection vulnerability
to execute arbitrary commands.

    CVE-2025-30265: If a remote attacker gains access to a user
account, they can then exploit the buffer overflow vulnerability
to modify memory or crash processes.

    CVE-2025-30267, CVE-2025-30268, CVE-2025-30272, CVE-2025-30274:
If a remote attacker gains access to a user account, they can then
exploit the NULL pointer dereference vulnerabilities to launch a
denial-of-service (DoS) attack.

    CVE-2025-30270, CVE-2025-30271, CVE-2025-33032: If a remote
attacker gains access to a user account, they can then exploit the
path traversal vulnerabilities to read the contents of unexpected
files or system data.

    CVE-2025-30273: If a remote attacker gains access to a user
account, they can then exploit the out-of-bounds write vulnerability
to modify or corrupt memory.

  

We have already fixed the vulnerabilities in the following versions:

Affected Product     Fixed Version

QTS 5.2.x            QTS 5.2.5.3145 build 20250526 and later
QuTS hero h5.2.x     QuTS hero h5.2.5.3138 build 20250519 and later


Recommendation

To secure your device, we recommend regularly updating your system
to the latest version to benefit from vulnerability fixes. You can
check the product support status to see the latest updates
available to your NAS model.


Updating QTS or QuTS hero

    Log in to QTS or QuTS hero as an administrator.
    Go to Control Panel > System > Firmware Update.
    Under Live Update, click Check for Update.
    The system downloads and installs the latest available update.

Tip: You can also download the update from the QNAP website.
Go to Support > Download Center and then perform a manual
update for your specific device.

  
Attachment

    CVE-2025-29882.json
    CVE-2025-30264.json
    CVE-2025-30265.json
    CVE-2025-30267.json
    CVE-2025-30268.json
    CVE-2025-30270.json
    CVE-2025-30271.json
    CVE-2025-30272.json
    CVE-2025-30274.json
    CVE-2025-30273.json
    CVE-2025-33032.json


Acknowledgements: coral, Searat and izut


Revision History:
V1.0 (August 29, 2025) - Published


=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================