Executive brief
QNAP operating systems, used to manage Network Attached Storage (NAS) devices for data storage and backup, are affected by a security vulnerability. If an attacker manages to obtain administrator credentials, they can exploit this flaw to further compromise the system's security and stability. This could lead to unauthorized changes to system settings or disruptions in data availability.
Technical details
This vulnerability involves an integer overflow or wraparound (CWE-190) and a stack-based buffer overflow (CWE-121) within several QNAP operating system versions. The flaw is reachable over the network but requires high privileges (administrator account). Successful exploitation allows an authenticated attacker to compromise system integrity and availability. QNAP has released patches for QTS and QuTS hero to address these issues.
Affected products
- QNAP QTS 5.2.9.3410 build 20260214 and later
- QNAP QuTS hero h5.2.9.3410 build 20260214 and later
- QNAP QuTS hero h5.3.4.3500 build 20260520 and later
- QNAP QuTS hero h6.0.0.3397 build 20260206 and later
Timeline
- 2026-06-10: disclosed
- 2026-06-10: advisory