Executive brief
A security vulnerability has been identified in QNAP's QTS and QuTS hero operating systems, which power their Network Attached Storage (NAS) devices. If an attacker manages to obtain administrator credentials, they can use this flaw to take full control of the device and execute unauthorized commands. This could lead to the theft of sensitive data, permanent loss of files, or the device being used as a foothold for further attacks on the corporate network.
Technical details
An OS command injection vulnerability (CWE-78) exists in multiple versions of QNAP's QTS and QuTS hero operating systems. The flaw allows a remote attacker with high privileges (administrator account) to bypass security restrictions and execute arbitrary system commands via the network. The vulnerability stems from improper neutralization of special elements used in an OS command. Successful exploitation results in complete compromise of the Confidentiality, Integrity, and Availability of the host system. QNAP has released security updates to address this issue in QTS 5.2.9.3410, QuTS hero h5.2.9.3410, h5.3.4.3500, and h6.0.0.3459.
Affected products
- QNAP QTS 5.2.x versions prior to 5.2.9.3410 build 20260214
- QNAP QuTS hero h5.2.x prior to h5.2.9.3410 build 20260214; h5.3.x prior to h5.3.4.3500 build 20260520; h6.0.x prior to h6.0.0.3459 build 20260409
Timeline
- 2026-06-10: disclosed
- 2026-06-10: advisory