This vulnerability (CVE-2025-66273) is a command injection flaw classified under CWE-78 affecting QNAP QTS operating system versions. An attacker who has obtained administrator privileges remotely can exploit this vulnerability to execute arbitrary commands on the system. The vendor has released fixes in multiple QTS and QuTS hero versions starting from builds dated early 2026. The vulnerability has a high CVSS 4.0 score of 8.6, reflecting its potential impact if exploited. No known exploits in the wild have been reported at this time.

If exploited, an attacker with administrator access can execute arbitrary commands on the affected QNAP device, potentially leading to full system compromise or unauthorized control of the device. This elevates the risk of data breaches, system manipulation, or disruption of services hosted on the device.

The vulnerability has been fixed in QTS 5.2.9.3410 build 20260214 and later, QuTS hero h5.2.9.3410 build 20260214 and later, QuTS hero h5.3.4.3500 build 20260520 and later, and QuTS hero h6.0.0.3397 build 20260206 and later. Users should upgrade to these versions or later to remediate the vulnerability. No additional mitigation guidance is provided by the vendor advisory.