This vulnerability (CVE-2025-62850) is a NULL pointer dereference in QNAP QuTS hero that can be exploited by a remote attacker who already has administrator access to trigger a denial-of-service attack. The vulnerability affects versions =5.2.0 and =5.3.0 of QuTS hero. The vendor has released patches in versions h5.2.9.3410 build 20260214 and later, h5.3.4.3500 build 20260520 and later, and h6.0.0.3459 build 20260409 and later. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no user interaction, and requires high privileges.

An attacker with administrator privileges can exploit this vulnerability to cause a denial-of-service condition by triggering a NULL pointer dereference, potentially disrupting availability of the affected QNAP QuTS hero system. There is no indication of remote code execution or data confidentiality/integrity impact. No known exploits in the wild have been reported.

The vulnerability has been fixed in QuTS hero versions h5.2.9.3410 build 20260214 and later, h5.3.4.3500 build 20260520 and later, and h6.0.0.3459 build 20260409 and later. Users should upgrade to these or later versions to remediate the issue. No other mitigation or temporary workaround is indicated.