Ce mail provient de l'extérieur, restons vigilants

=====================================================================

                            CERT-Renater

                Note d'Information No. 2025/VULN671
_____________________________________________________________________

DATE                : 07/10/2025

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running QTS versions prior to
                        5.2.6.3195 build 20250715,
             QuTS hero versions prior to h5.2.6.3195 build 20250715.

=====================================================================
https://www.qnap.com/fr-fr/security-advisory/qsa-25-36
_____________________________________________________________________

Security ID : QSA-25-36
Multiple Vulnerabilities in QTS and QuTS hero

    Release date : October 4, 2025

    CVE identifier : CVE-2025-47211 | CVE-2025-47212 | CVE-2025-47213
| CVE-2025-47214 | CVE-2025-48726 | CVE-2025-48727 | CVE-2025-48728
| CVE-2025-48729 | CVE-2025-48730 | CVE-2025-52424 | CVE-2025-52427
| CVE-2025-52428 | CVE-2025-52429 | CVE-2025-52432 | ...


    Affected products: QTS 5.2.x, QuTS hero h5.2.x

Severity
Moderate

Status
Resolved


Summary

Multiple vulnerabilities have been reported to affect certain QNAP
operating system versions:

    CVE-2025-47211: Path traversal vulnerability
    If a remote attacker gains access to an administrator account,
they can then exploit the vulnerability to read the contents of
unexpected files or system data.

    CVE-2025-47212: Command injection vulnerability

    If a remote attacker gains access to an administrator account,
they can then exploit the vulnerability to execute arbitrary
commands.

    CVE-2025-47213, CVE-2025-47214, CVE-2025-48726, CVE-2025-48727,
CVE-2025-48728, CVE-2025-48729, CVE-2025-52424, CVE-2025-52427,
CVE-2025-52428, CVE-2025-52432, CVE-2025-52433, CVE-2025-52853,
CVE-2025-52854, CVE-2025-52855, CVE-2025-52857, CVE-2025-52858,
CVE-2025-52859, CVE-2025-52860, CVE-2025-52862, CVE-2025-52866:
NULL pointer dereference vulnerabilities

    If a remote attacker gains access to an administrator account,
they can then exploit the vulnerabilities to launch a
denial-of-service (DoS) attack.

    CVE-2025-48730, CVE-2025-52429, CVE-2025-53406, CVE-2025-53407:
Use of externally-controlled format string vulnerabilities

    If a remote attacker gains access to an administrator account,
they can then exploit the vulnerabilities to obtain secret data or
modify memory.

  
We have already fixed the vulnerabilities in the following
versions:

Affected Product 	Fixed Version
QTS 5.2.x               QTS 5.2.6.3195 build 20250715 and later
QuTS hero h5.2.x        QuTS hero h5.2.6.3195 build 20250715
                              and later


Recommendation

To secure your device, we recommend regularly updating your
system to the latest version to benefit from vulnerability
fixes. You can check the product support status to see the
latest updates available to your NAS model.


Updating QTS or QuTS hero

    Log in to QTS or QuTS hero as an administrator.
    Go to Control Panel > System > Firmware Update.
    Under Live Update, click Check for Update.
    The system downloads and installs the latest available
update.

Tip: You can also download the update from the QNAP website.
Go to Support > Download Center and then perform a manual
update for your specific device.


Attachment

    CVE-2025-47211.json
    CVE-2025-47212.json
    CVE-2025-47213.json
    CVE-2025-47214.json
    CVE-2025-48726.json
    CVE-2025-48727.json
    CVE-2025-48728.json
    CVE-2025-48729.json
    CVE-2025-48730.json
    CVE-2025-52424.json
    CVE-2025-52427.json
    CVE-2025-52428.json
    CVE-2025-52429.json
    CVE-2025-52433.json
    CVE-2025-52853.json
    CVE-2025-52854.json
    CVE-2025-52855.json
    CVE-2025-52857.json
    CVE-2025-52858.json
    CVE-2025-52859.json
    CVE-2025-52860.json
    CVE-2025-52862.json
    CVE-2025-52866.json
    CVE-2025-53406.json
    CVE-2025-53407.json
    CVE-2025-52432.json


Acknowledgements: coral, Yuze Wu(h1J4cker),


Revision History:
V1.0 (October 4, 2025) - Published


=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================