CVE-2025-66281
Received Received - Intake
NULL Pointer Dereference in QNAP QTS and QuTS hero

Publication date: 2026-06-10

Last updated on: 2026-06-10

Assigner: QNAP Systems, Inc.

Description
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QTS 5.2.9.3410 build 20260214 and later QuTS hero h5.2.9.3410 build 20260214 and later QuTS hero h5.3.4.3500 build 20260520 and later QuTS hero h6.0.0.3397 build 20260206 and later
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-10
Last Modified
2026-06-10
Generated
2026-06-10
AI Q&A
2026-06-10
EPSS Evaluated
N/A
NVD
CVE-2025-66281
EUVD
EUVD-2025-210102
Affected Vendors & Products
Showing 4 associated CPEs
Vendor Product Version / Range
qnap qts From 5.2.9.3410 (inc)
qnap quts_hero From h5.2.9.3410 (inc)
qnap quts_hero From h5.3.4.3500 (inc)
qnap quts_hero From h6.0.0.3397 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is a NULL pointer dereference issue affecting several versions of QNAP operating systems. It allows remote attackers to exploit the flaw to cause a denial-of-service (DoS) attack, which can disrupt the normal operation of the affected system.

Impact Analysis

The vulnerability can be exploited remotely to launch a denial-of-service (DoS) attack, which may cause the affected QNAP system to crash or become unresponsive, leading to service disruption and potential downtime.

Mitigation Strategies

To mitigate this vulnerability, you should update your QNAP operating system to one of the fixed versions listed below:

  • QTS 5.2.9.3410 build 20260214 or later
  • QuTS hero h5.2.9.3410 build 20260214 or later
  • QuTS hero h5.3.4.3500 build 20260520 or later
  • QuTS hero h6.0.0.3397 build 20260206 or later

Applying these updates will fix the NULL pointer dereference vulnerability and prevent potential denial-of-service attacks.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-66281. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart