# CVE-2025-66273: QNAP QTS and QuTS hero command injection

Source: https://junglewise.ai/threats/cve-2025-66273-qnap-qts-and-quts-hero-command-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-10. Updated: 2026-06-10  
License: CC BY 4.0 with a link back

CVE-2025-66273 · Severity: info · CVSS 8.6 · Published 2026-06-10

A security vulnerability has been identified in QNAP storage device operating systems that could allow an attacker with administrative access to take full control of the system. By exploiting this flaw, an attacker can bypass normal security restrictions to run unauthorized commands, potentially leading to data theft, service disruption, or complete system compromise. Users are advised to update their QTS or QuTS hero firmware to the latest versions to mitigate this risk.

Technologies: [QNAP QTS](https://junglewise.ai/threats/technologies/qts). Vendors: [QNAP](https://junglewise.ai/threats/vendors/qnap).

## Quick answers

**Is CVE-2025-66273 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-66273 being exploited in the wild.

**How severe is CVE-2025-66273?** Informational severity, with a CVSS score of 8.6, published 10 June 2026.

**Which products and versions are affected?** QNAP QTS 5.2.x versions prior to 5.2.9.3410 build 20260214.

**Is there a fix for CVE-2025-66273?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-66273 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2025-66273?** Check whether you run QNAP QTS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A command injection vulnerability (CWE-78) exists in multiple QNAP operating systems, including QTS and QuTS hero. The flaw allows a remote attacker who has already obtained administrator-level privileges to inject and execute arbitrary OS commands via the network. This occurs due to improper neutralization of special elements used in an OS command. While the attack requires high privileges (PR:H), successful exploitation results in a total compromise of confidentiality, integrity, and availability (VC:H/VI:H/VA:H). QNAP has released firmware updates to address this issue across several product lines.

## Affected products

- QNAP QTS 5.2.x versions prior to 5.2.9.3410 build 20260214
- QNAP QuTS hero h5.2.x prior to h5.2.9.3410 build 20260214; h5.3.x prior to h5.3.4.3500 build 20260520; h6.0.x prior to h6.0.0.3397 build 20260206

## Timeline

- 2026-06-10: disclosed
- 2026-06-10: advisory

## References

- [https://www.qnap.com/en/security-advisory/qsa-26-10](https://www.qnap.com/en/security-advisory/qsa-26-10)

## Related threats

- [QNAP QTS and QuTS hero path traversal](https://junglewise.ai/threats/cve-2026-24717-qnap-qts-and-quts-hero-path-traversal)
- [QNAP QTS and QuTS hero NULL pointer dereference DoS](https://junglewise.ai/threats/cve-2026-24716-qnap-qts-and-quts-hero-null-pointer-dereference-dos)
- [QNAP QTS and QuTS hero command injection](https://junglewise.ai/threats/cve-2026-22893-qnap-qts-and-quts-hero-command-injection)
- [QNAP QTS and QuTS web parameter manipulation](https://junglewise.ai/threats/cve-2025-59382-qnap-qts-and-quts-web-parameter-manipulation)
- [QNAP QTS and QuTS hero NULL pointer dereference](https://junglewise.ai/threats/cve-2025-66274-qnap-qts-and-quts-hero-null-pointer-dereference)