CVE-2025-66273 is a command injection vulnerability (CWE-78) affecting QNAP QTS operating system versions. An attacker who has obtained administrator credentials can exploit this flaw to execute arbitrary commands remotely. The vulnerability has been addressed by QNAP in specific builds of QTS and QuTS hero starting from versions 5.2.9.3410 build 20260214 and later for QTS and QuTS hero h5.2.9.3410, as well as later builds for QuTS hero h5.3.4 and h6.0.0. The CVSS v4.0 base score is 8.6, indicating high severity with network attack vector, low attack complexity, no privileges required beyond administrator, and no user interaction needed. There are no known exploits in the wild at this time.

If exploited, this vulnerability allows an attacker with administrator privileges to execute arbitrary commands on the affected QNAP system remotely. This could lead to full system compromise, unauthorized access to data, and disruption of services. The high CVSS score reflects the significant impact of successful exploitation.

Official fixes are available and have been released by QNAP. Users should upgrade affected QTS and QuTS hero systems to versions 5.2.9.3410 build 20260214 or later for QTS, and the specified fixed versions for QuTS hero. Applying these updates will remediate the vulnerability. No additional mitigation steps are indicated by the vendor advisory.