QNAP Patches Critical Flaw (CVE-2025-52856) with CVSS 9.3

QNAP has released a security advisory addressing multiple vulnerabilities affecting the QVR firmware on legacy VioStor NVR devices. The first issue, tracked as CVE-2025-52856 and rated Critical (CVSSv4 9.3), is an improper authentication vulnerability; according to QNAP, “A remote attacker can exploit the improper authentication vulnerability to compromise the security of the system.” This could allow a remote attacker to bypass authentication safeguards and gain unauthorised access.

The second flaw, CVE-2025-52861, carries a CVSSv4 score of 7.0 and is a path traversal vulnerability; as QNAP explains, “If a remote attacker gains access to an administrator account, they can then exploit the path traversal vulnerability to read the contents of unexpected files or system data.” The vulnerabilities have been addressed in Legacy VioStor NVR: QVR 5.1.x and Legacy VioStor NVR: QVR 5.1.6 build 20250621 and later, with users advised to update to the latest firmware to mitigate risk.