CVE-2025-66281: CWE-476 in QNAP Systems Inc. QTS
CVE-2025-66281 is a NULL pointer dereference vulnerability in QNAP Systems Inc. QTS operating system that allows remote attackers to cause a denial-of-service (DoS) condition. The vulnerability affects several versions of QTS and QuTS hero. Official fixes have been released in QTS 5. 2. 9. 3410 build 20260214 and later, QuTS hero h5. 2. 9. 3410 build 20260214 and later, QuTS hero h5.
AI Analysis
Technical Summary
This vulnerability is a NULL pointer dereference (CWE-476) in QNAP QTS operating system versions, which can be exploited remotely without authentication to trigger a denial-of-service (DoS) attack. The issue has been addressed by QNAP in specific builds of QTS and QuTS hero starting from versions 5.2.9.3410 and later. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and low impact on availability.
Potential Impact
Successful exploitation results in a denial-of-service condition, causing the affected QNAP device to crash or become unresponsive. There is no indication of data confidentiality or integrity impact. The vulnerability can be triggered remotely without authentication.
Mitigation Recommendations
The vulnerability has been fixed by QNAP in QTS 5.2.9.3410 build 20260214 and later, QuTS hero h5.2.9.3410 build 20260214 and later, QuTS hero h5.3.4.3500 build 20260520 and later, and QuTS hero h6.0.0.3397 build 20260206 and later. Users should upgrade to these fixed versions to remediate the issue. No other mitigation or workaround is specified.
CVE-2025-66281: CWE-476 in QNAP Systems Inc. QTS
Description
CVE-2025-66281 is a NULL pointer dereference vulnerability in QNAP Systems Inc. QTS operating system that allows remote attackers to cause a denial-of-service (DoS) condition. The vulnerability affects several versions of QTS and QuTS hero. Official fixes have been released in QTS 5. 2. 9. 3410 build 20260214 and later, QuTS hero h5. 2. 9. 3410 build 20260214 and later, QuTS hero h5.
CVSS v4.0
Score 6.9medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability is a NULL pointer dereference (CWE-476) in QNAP QTS operating system versions, which can be exploited remotely without authentication to trigger a denial-of-service (DoS) attack. The issue has been addressed by QNAP in specific builds of QTS and QuTS hero starting from versions 5.2.9.3410 and later. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and low impact on availability.
Potential Impact
Successful exploitation results in a denial-of-service condition, causing the affected QNAP device to crash or become unresponsive. There is no indication of data confidentiality or integrity impact. The vulnerability can be triggered remotely without authentication.
Mitigation Recommendations
The vulnerability has been fixed by QNAP in QTS 5.2.9.3410 build 20260214 and later, QuTS hero h5.2.9.3410 build 20260214 and later, QuTS hero h5.3.4.3500 build 20260520 and later, and QuTS hero h6.0.0.3397 build 20260206 and later. Users should upgrade to these fixed versions to remediate the issue. No other mitigation or workaround is specified.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- qnap
- Date Reserved
- 2025-11-26T09:25:37.833Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a28dcc28dd33fbd85dba9bd
Added to database: 6/10/2026, 3:40:50 AM
Last enriched: 6/10/2026, 3:56:43 AM
Last updated: 6/10/2026, 8:12:39 AM
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.