CVE-2025-66280

Analyzed Analyzed - Analysis Complete

Integer Overflow in QNAP QTS and QuTS hero

Publication date: 2026-06-10

Last updated on: 2026-06-15

Assigner: QNAP Systems, Inc.

Description

An integer overflow or wraparound vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following versions: QTS 5.2.9.3410 build 20260214 and later QuTS hero h5.2.9.3410 build 20260214 and later QuTS hero h5.3.4.3500 build 20260520 and later QuTS hero h6.0.0.3397 build 20260206 and later

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-10

Last Modified

2026-06-15

Generated

2026-06-30

AI Q&A

2026-06-10

EPSS Evaluated

2026-06-29

NVD

CVE-2025-66280

EUVD

EUVD-2025-210101

Affected Vendors & Products

Vendor	Product	Version / Range
qnap	quts_hero	From h5.3.0.3115 (inc) to h5.3.4.3500 (exc)
qnap	qts	From 5.2.0.2737 (inc) to 5.2.9.3410 (exc)
qnap	quts_hero	From h5.2.0.2737 (inc) to h5.2.9.3410 (exc)
qnap	quts_hero	From h6.0.0.3324 (inc) to h6.0.0.3397 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-190	The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.
CWE-121	A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

Executive Summary

This vulnerability is an integer overflow or wraparound issue affecting several versions of QNAP operating systems. It allows a remote attacker who has already obtained an administrator account to exploit the vulnerability and compromise the security of the system.

Impact Analysis

If exploited, this vulnerability can lead to a security compromise of the affected QNAP system. Since it requires an attacker to have an administrator account, the attacker could potentially perform unauthorized actions or gain further control over the system.

Mitigation Strategies

To mitigate this vulnerability, you should update your QNAP operating system to one of the fixed versions listed below:

QTS 5.2.9.3410 build 20260214 or later
QuTS hero h5.2.9.3410 build 20260214 or later
QuTS hero h5.3.4.3500 build 20260520 or later
QuTS hero h6.0.0.3397 build 20260206 or later

Additionally, since exploitation requires a remote attacker to have an administrator account, ensure that administrator credentials are secure and access is tightly controlled.

Hi! I’m here to help you understand CVE-2025-66280. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70