Critical .NET Flaw (CVE-2025-55315) in QNAP: NAS Backup Utility Vulnerable to Credential Theft

According to Microsoft, the critical vulnerability CVE-2025-55315 carries a CVSS score of 9.8 and affects ASP.NET, with attackers potentially intercepting credentials or bypassing front-end controls via HTTP request smuggling. Earlier, QNAP issued a security advisory urging users to apply the patch because its NetBak PC Agent backup utility for QNAP NAS devices also relies on ASP.NET Core and is vulnerable to this flaw.

The advisory notes that an authenticated attacker with limited privileges could send specially crafted HTTP requests to the web server, potentially leading to unauthorized data access, modification of server files, or a limited denial-of-service attack. As of October 2025, the latest ASP.NET Core runtime version recommended by QNAP is to reinstall NetBak PC Agent or update to ASP.NET Core Runtime (Hosting Bundle) 8.0.21, with the latter available via the .NET 8.0 download page.

The article emphasises that upgrading ASP.NET Core components is crucial, especially in enterprise environments where unpatched systems could leave significant security gaps.