QNAP Flaw Allows Attackers to Bypass Authentication

QNAP Systems has released security patches to address multiple vulnerabilities affecting QVR firmware in legacy VioStor NVR systems. According to QNAP’s security advisory QSA-25-29, the company disclosed two significant flaws on 29 August 2025, urging users to update their systems immediately.

The first vulnerability, CVE-2025-52856, is an improper authentication flaw that could allow remote attackers to bypass credentials and access the system, while the second, CVE-2025-52861, is a path traversal flaw that becomes exploitable after administrator access is gained. Both vulnerabilities are rated as Important, with discovery credited to security researcher Hou Liuyang from 360 Security, and they affect legacy VioStor NVR systems running QVR 5.1.x firmware.

QNAP’s patch upgrades affected devices to QVR 5.1.6 build 20250621 or later, and administrators are advised to update via the Control Panel’s System Settings and verify their firmware on the official download portal, noting the update is described as a “Resolved” fix.