Critical Warning: QNAP Patches Seven Zero-Days Exploited at Pwn2Own 2025

According to QNAP, seven zero-day vulnerabilities were exploited live at Pwn2Own Ireland 2025, with patches released for the core operating systems and key applications to mitigate the risk to NAS devices. The flaws were found across QTS and QuTS hero, including CVE-2025-62847, CVE-2025-62848 and CVE-2025-62849 in the main OS, and in backup and data protection tools such as HBS 3 Hybrid Backup Sync (CVE-2025-62840, CVE-2025-62842) and Hyper Data Protector (CVE-2025-59389).

Malware Remover also contained a zero-day (CVE-2025-11837) and has been updated to version 6.6.8.20251023 for affected users. Patches were issued as follows: QTS 5.2.x is fixed in 5.2.7.3297 build 20251024 and later, QUTS hero h5.2.x in 5.2.7.3297 build 20251024 and later, and QUTS hero h5.3.x in 5.3.1.3292 build 20251024 and later. The article notes that exploits were demonstrated by multiple research teams, and urges immediate application of the firmware and application updates to protect stored data.