6.6 MediumCWE-88
CVE-2025-62847
QTS, QuTS hero
Status
- Not in CISA KEV
- Vendor fix available
Exploit probabilityEPSSchecked 25 Oct
0.8%probability of exploitation in the next 30 days
Higher than 57% of scored CVEs
SeverityCVSS
6.6Medium
Description NVD
An improper neutralization of argument delimiters in a command vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to alter execution logic. We have already fixed the vulnerability in the following versions: QTS 5.2.7.3297 build 20251024 and later QuTS hero h5.2.7.3297 build 20251024 and later QuTS hero h5.3.1.3292 build 20251024 and later
Coverage 1 article · 1 outlet
- QNAP fixed four vulnerabilities demonstrated at Pwn2Own Ireland 2025Security Affairs · first in our coverage · mentions it in passing