This vulnerability (CVE-2025-62850) involves a NULL pointer dereference in QNAP's QuTS hero OS. Exploitation requires the attacker to have administrator-level access, after which they can trigger a denial-of-service attack by exploiting the NULL pointer dereference. The vendor has fixed the issue in QuTS hero versions h5.2.9.3410 build 20260214 and later, h5.3.4.3500 build 20260520 and later, and h6.0.0.3459 build 20260409 and later. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required beyond administrator, no user interaction, and low impact on confidentiality and integrity but availability impact is low.

Successful exploitation allows a remote attacker with administrator privileges to cause a denial-of-service condition by triggering a NULL pointer dereference. This results in service disruption of the affected QuTS hero system. There is no indication of confidentiality or integrity compromise from this vulnerability.

The vulnerability has been fixed in QuTS hero versions h5.2.9.3410 build 20260214 and later, h5.3.4.3500 build 20260520 and later, and h6.0.0.3459 build 20260409 and later. Users should upgrade to these or later versions to remediate the issue. No additional mitigation steps are indicated by the vendor advisory.