Executive brief
A security vulnerability has been identified in QNAP storage device operating systems that could allow an attacker with administrative access to take full control of the system. By exploiting this flaw, an attacker can bypass normal security restrictions to run unauthorized commands, potentially leading to data theft, service disruption, or complete system compromise. Users are advised to update their QTS or QuTS hero firmware to the latest versions to mitigate this risk.
Technical details
A command injection vulnerability (CWE-78) exists in multiple QNAP operating systems, including QTS and QuTS hero. The flaw allows a remote attacker who has already obtained administrator-level privileges to inject and execute arbitrary OS commands via the network. This occurs due to improper neutralization of special elements used in an OS command. While the attack requires high privileges (PR:H), successful exploitation results in a total compromise of confidentiality, integrity, and availability (VC:H/VI:H/VA:H). QNAP has released firmware updates to address this issue across several product lines.
Affected products
- QNAP QTS 5.2.x versions prior to 5.2.9.3410 build 20260214
- QNAP QuTS hero h5.2.x prior to h5.2.9.3410 build 20260214; h5.3.x prior to h5.3.4.3500 build 20260520; h6.0.x prior to h6.0.0.3397 build 20260206
Timeline
- 2026-06-10: disclosed
- 2026-06-10: advisory