Executive brief
A security vulnerability has been identified in QNAP operating systems used to manage Network Attached Storage (NAS) devices. If an attacker manages to obtain administrator credentials, they can exploit this flaw to run unauthorized commands on the system. This could lead to a complete takeover of the device, resulting in data loss, service disruption, or unauthorized access to stored files.
Technical details
A command injection vulnerability (CWE-78) exists in several QNAP operating system versions, including QTS and QuTS hero. The flaw is rooted in the improper neutralization of special elements used in OS commands. An attacker with high privileges (administrator account) can exploit this vulnerability over the network without user interaction to execute arbitrary commands with system-level permissions. QNAP has released security updates to address this issue in QTS 5.2.9.3410, QuTS hero h5.2.9.3410, h5.3.4.3500, and h6.0.0.3397.
Affected products
- QNAP Systems, Inc. QTS 5.2.x prior to 5.2.9.3410 build 20260214
- QNAP Systems, Inc. QuTS hero h5.2.x prior to h5.2.9.3410 build 20260214; h5.3.x prior to h5.3.4.3500 build 20260520; h6.0.x prior to h6.0.0.3397 build 20260206
Timeline
- 2026-06-10: disclosed
- 2026-06-10: advisory