This vulnerability (CWE-476) involves a NULL pointer dereference in QNAP QTS, which can be triggered by an attacker who already has administrator access. Exploiting this flaw results in a denial-of-service (DoS) attack against the affected system. The vendor has released fixed versions addressing this issue in QTS 5.2.9.3492 build 20260507 and later, and corresponding QuTS hero versions. The CVSS 4.0 vector indicates network attack vector, low complexity, no user interaction, and requires high privileges, with low confidentiality, integrity, and availability impacts.

An attacker with administrator privileges can exploit this vulnerability to cause a denial-of-service condition by triggering a NULL pointer dereference. This may disrupt the availability of the QNAP system. The impact is limited to DoS and requires prior administrative access, reducing the overall risk.

The vulnerability has been fixed in QTS 5.2.9.3492 build 20260507 and later versions, as well as in QuTS hero h5.2.9.3499 build 20260514 and later, h5.3.4.3500 build 20260520 and later, and h6.0.0.3459 build 20260409 and later. Users should upgrade to these fixed versions to remediate the issue. No additional mitigation steps are indicated.