CVE-2025-54164
BaseFortify
Publication date: 2026-01-02
Last updated on: 2026-01-05
Assigner: QNAP Systems, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| qnap | quts_hero | h5.2.0.2737 |
| qnap | quts_hero | h5.2.0.2782 |
| qnap | quts_hero | h5.2.0.2789 |
| qnap | quts_hero | h5.2.0.2802 |
| qnap | quts_hero | h5.2.0.2823 |
| qnap | quts_hero | h5.2.0.2851 |
| qnap | quts_hero | h5.2.0.2860 |
| qnap | quts_hero | h5.2.1.2929 |
| qnap | quts_hero | h5.2.1.2940 |
| qnap | quts_hero | h5.2.2.2952 |
| qnap | quts_hero | h5.2.3.3006 |
| qnap | quts_hero | h5.2.4.3070 |
| qnap | quts_hero | h5.2.4.3079 |
| qnap | quts_hero | h5.2.5.3138 |
| qnap | quts_hero | h5.2.6.3195 |
| qnap | quts_hero | h5.3.0.3115 |
| qnap | quts_hero | h5.3.0.3145 |
| qnap | quts_hero | h5.3.0.3192 |
| qnap | qts | 5.2.0.2737 |
| qnap | qts | 5.2.0.2744 |
| qnap | qts | 5.2.0.2782 |
| qnap | qts | 5.2.0.2802 |
| qnap | qts | 5.2.0.2823 |
| qnap | qts | 5.2.0.2851 |
| qnap | qts | 5.2.0.2860 |
| qnap | qts | 5.2.1.2930 |
| qnap | qts | 5.2.2.2950 |
| qnap | qts | 5.2.3.3006 |
| qnap | qts | 5.2.4.3070 |
| qnap | qts | 5.2.4.3079 |
| qnap | qts | 5.2.4.3092 |
| qnap | qts | 5.2.5.3145 |
| qnap | qts | 5.2.6.3195 |
| qnap | qts | 5.2.6.3229 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-125 | The product reads data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an out-of-bounds read issue affecting several QNAP operating system versions. If a remote attacker obtains an administrator account, they can exploit this vulnerability to access secret data.
How can this vulnerability impact me? :
If exploited by a remote attacker with administrator access, this vulnerability can lead to unauthorized disclosure of secret data, potentially compromising sensitive information stored or processed by the affected QNAP systems.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, immediately update your QNAP operating system to one of the fixed versions: QTS 5.2.7.3256 build 20250913 or later, QuTS hero h5.2.7.3256 build 20250913 or later, or QuTS hero h5.3.1.3250 build 20250912 or later. Ensure that remote administrator accounts are secured to prevent unauthorized access.