Critical QNAP .NET Flaw Lets Attackers Bypass Security Protections

According to QNAP, a critical flaw in Microsoft ASP.NET Core has been found in NetBak PC Agent, tracked as CVE-2025-55315, which can allow authenticated attackers to bypass security controls via HTTP Request Smuggling. The vulnerability carries a CVSS score of 8.1 (high) and targets ASP.NET Core’s HTTP request handling, enabling attackers to access sensitive data, modify server files, or trigger limited denial-of-service conditions that could disrupt backups.

The flaw requires authentication, meaning an attacker would need some level of system access or credentials, though insider threats and compromised accounts remain realistic attack scenarios. QNAP has issued urgent recommendations to update the ASP.NET Core runtime, and two primary remediation paths are outlined: reinstalling NetBak PC Agent or manually updating the ASP.NET Core Runtime Hosting Bundle to the latest version.

As of October 2025, the current runtime version is 8.0.21, and administrators are advised to restart affected applications or systems after updates and to test patches in controlled environments before wide deployment.