Critical ASP.NET flaw hits QNAP NetBak PC Agent

QNAP has warned of a critical ASP.NET Core vulnerability, tracked as CVE-2025-55315, in NetBak PC Agent for Windows, with a CVSS of 9.9, that could allow low-privilege attackers to hijack credentials or bypass front-end security via HTTP smuggling. According to Microsoft, the flaw stems from inconsistent interpretation of http requests in ASP.NET Core, enabling an authorised attacker to smuggle another HTTP request and bypass security controls or hijack other users’ credentials.

The advisory published by QNAP adds that NetBak PC Agent installs and depends on Microsoft ASP.NET Core components, so unpatched systems may contain an affected runtime. If exploited, an authenticated attacker could access sensitive data, modify server files, or cause a limited denial-of-service by sending crafted HTTP requests.

QNAP recommends two remediation paths: reinstalling NetBak PC Agent with the latest installer, which updates the ASP.NET Core runtime, or manually updating ASP.NET Core to the latest hosting bundle (currently 8.0.21 as of October 2025) and restarting the application or system. The guidance underscores patching Windows systems to ensure the latest Microsoft ASP.NET Core updates are installed.