QNAP Patches Vulnerabilities Exploited at Pwn2Own Ireland

QNAP has issued patches for two dozen vulnerabilities across its product range, including seven flaws demonstrated at Pwn2Own Ireland 2025, with remote code execution, information disclosure and DoS risks cited. CVE-2025-62840 and CVE-2025-62842 were demonstrated by Team DDOS, who earned a $100,000 reward for an exploit chaining eight flaws affecting QNAP routers and NAS devices on the event’s first day.

Other defects—CVE-2025-62847, CVE-2025-62848 and CVE-2025-62849—were shown by DEVCORE researchers, earning them $40,000 for an exploit combining injection vulnerabilities with a format string bug. Patches cover QTS 5.2.7.3297 build 20251024, QuTS hero h5.2.7.3297 build 20251024 and h5.3.1.3292 build 20251024, along with HBS 3 Hybrid Backup Sync 26.2.0.938; Malware Remover 6.6.8.20251023 also fixes CVE-2025-11837, a critical code injection issue demonstrated by CyCraft researcher Chumy Tsai on a TS-453E NAS.

Additional fixes address CVE-2025-59389 in Hyper Data Protector, demonstrated by Sina Kheirkhah of Summoning Team, and a chained hardcoded credential/injection flaw. The vendor notes no known exploits in the wild, and users are advised to apply patches promptly and, after updating, to change all passwords, according to QNAP’s security advisories page.