An SQL injection vulnerability (CWE-89) exists in QNAP QTS versions 5.2.x that could allow remote attackers to execute unauthorized commands or code by injecting malicious SQL statements. The vulnerability is remotely exploitable without privileges and requires user interaction. The vendor has released official fixes in QTS 5.2.7.3297 build 20251024 and later, as well as in QuTS hero h5.2.7.3297 and h5.3.1.3292 builds from the same date. The CVSS 4.0 score of 5.2 reflects medium severity, indicating a moderate risk if unpatched.

Successful exploitation of this vulnerability could allow remote attackers to execute unauthorized code or commands on affected QNAP devices, potentially compromising system integrity and confidentiality. However, the vulnerability requires user interaction and has no known active exploits in the wild, which reduces immediate risk.

Apply the official vendor patches by upgrading to QTS 5.2.7.3297 build 20251024 or later, or the corresponding QuTS hero versions mentioned. Since the vendor has released these fixes, remediation is available and should be applied promptly to mitigate the vulnerability.