This vulnerability (CVE-2025-66279) is a command injection flaw (CWE-78) in QNAP QTS operating system. It requires an attacker to have administrator privileges to exploit, enabling arbitrary command execution remotely. The vulnerability affects QTS 5.2.0 and earlier versions prior to the fixed releases. The vendor has issued patches in QTS 5.2.9.3410 build 20260214 and later, and corresponding QuTS hero versions. The CVSS 4.0 score is 8.6, indicating a high severity with network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability.

If exploited, an attacker with administrator access can execute arbitrary commands on the affected QNAP device, potentially leading to full system compromise. This can impact confidentiality, integrity, and availability of the system and data stored on it.

The vulnerability has been fixed by QNAP in QTS 5.2.9.3410 build 20260214 and later, QuTS hero h5.2.9.3410 build 20260214 and later, h5.3.4.3500 build 20260520 and later, and h6.0.0.3397 build 20260206 and later. Users should upgrade to these fixed versions to remediate the vulnerability. No other mitigation or temporary fix is indicated.