QNAP fixed multiple zero-days in its software demonstrated at Pwn2Own 2025

QNAP has patched seven zero-day vulnerabilities that were demonstrated at Pwn2Own 2025, affecting QTS, QuTS hero, Hyper Data Protector, Malware Remover and HBS 3 Hybrid Backup Sync. The flaws, addressed by updates to several products, include CVE-2025-62847, CVE-2025-62848 and CVE-2025-62849 in QTS and QuTS hero, CVE-2025-11837 in Malware Remover, CVE-2025-59389 in Hyper Data Protector, and CVE-2025-62840 and CVE-2025-62842 in HBS 3 Hybrid Backup Sync.

The vendor recommends that customers upgrade to the latest versions listed, noting that “To secure your device, we recommend regularly updating your system to the latest version to benefit from vulnerability fixes.” White-hat researchers from Summoning Team, DEVCORE, Team DDOS and a CyCraft intern demonstrated these vulnerabilities at Pwn2Own 2025. The article also recalls that in October 2024 QNAP addressed two prior zero-days tracked as CVE-2024-50388 and CVE-2024-50387 demonstrated at Pwn2Own Ireland 2024.