Executive brief
A security vulnerability has been identified in QNAP NAS operating systems that could allow an attacker with administrative access to take full control of the device. By exploiting this flaw, an authorized user can bypass security restrictions to run unauthorized system commands. This could lead to the complete compromise of stored data, service disruptions, or the use of the device as a foothold for further attacks within the corporate network.
Technical details
An OS command injection vulnerability (CWE-78) exists in several QNAP operating system versions, including QTS and QuTS hero. The flaw allows a remote attacker who has already obtained high-privilege (administrator) credentials to inject and execute arbitrary system commands via the network. This occurs due to improper neutralization of special elements used in OS commands within the system's management interface. Successful exploitation results in full system compromise with the privileges of the executing process. QNAP has released security updates to address this issue in QTS 5.2.9.3492 build 20260507 and QuTS hero h5.2.9.3499 build 20260514.
Affected products
- QNAP Systems, Inc. QTS 5.2.x versions prior to 5.2.9.3492 build 20260507
- QNAP Systems, Inc. QuTS hero h5.2.x versions prior to h5.2.9.3499 build 20260514
Timeline
- 2026-06-10: disclosed
- 2026-06-10: advisory: QNAP advisory QSA-26-23 published