This vulnerability (CVE-2025-66279) is a command injection flaw (CWE-78) in QNAP QTS and QuTS hero operating systems. An attacker who has obtained administrator access can exploit this vulnerability to execute arbitrary commands on the affected system. The vendor has fixed the issue in QTS 5.2.9.3410 build 20260214 and later, QuTS hero h5.2.9.3410 build 20260214 and later, QuTS hero h5.3.4.3500 build 20260520 and later, and QuTS hero h6.0.0.3397 build 20260206 and later. The CVSS 4.0 base score is 8.6, indicating high severity, with network attack vector, low attack complexity, no user interaction, and requiring high privileges.

If exploited, this vulnerability allows an attacker with administrator privileges to execute arbitrary commands on the affected QNAP device, potentially leading to full system compromise. This can result in unauthorized control over the device and its data. No known exploits in the wild have been reported at this time.

The vulnerability has been fixed in QTS 5.2.9.3410 build 20260214 and later, QuTS hero h5.2.9.3410 build 20260214 and later, QuTS hero h5.3.4.3500 build 20260520 and later, and QuTS hero h6.0.0.3397 build 20260206 and later. Users should upgrade to these versions or later to remediate the vulnerability. No additional mitigation guidance is provided.