QNAP NetBak PC Agent Affected by Recent ASP.NET Core Vulnerability

QNAP Systems says its NetBak PC Agent is potentially affected by a recently disclosed ASP.NET Core vulnerability that has the highest ever CVSS score for the framework. Tracked as CVE-2025-55315, the flaw carries a CVSS score of 9.9 and is an HTTP request smuggling defect that could allow attackers to bypass security controls or hijack other users’ credentials.

Microsoft patched the vulnerability on October 2025 Patch Tuesday, warning that it could be exploited to leak sensitive information, tamper with file contents, or cause a server crash. According to QNAP, NetBak PC Agent installs and depends on ASP.NET Core components during setup, which could result in a vulnerable version running on unpatched systems.

The agent is a Windows application that enables users to back up and restore data to a QNAP NAS, making remediation important given the potential impact on backup data if exploited. The company urges users to apply the patches for ASP.NET Core, either by reinstalling the agent or by manually updating the framework.