Vulnerability details
CVE-2025-59385
QNAP Systems QTSQNAP Systems QuTS hero
QTS, QuTS hero
CVSS 4.0
8.1High
Official description
An authentication bypass by spoofing vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to access resources which are not otherwise accessible without proper authentication. We have already fixed the vulnerability in the following versions: QTS 5.2.7.3297 build 20251024 and later QuTS hero h5.2.7.3297 build 20251024 and later QuTS hero h5.3.1.3292 build 20251024 and later
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.1High | 4.0 | CVEProject cvelistV5 (CNA) (qnap) | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| QNAP Systems Inc. | QTS | 5.2.x ≤ v < 5.2.7.3297 build 20251024 | CVEProject cvelistV5 (CNA) |
| QNAP Systems Inc. | QuTS hero | h5.2.x ≤ v < h5.2.7.3297 build 20251024 | CVEProject cvelistV5 (CNA) |
| QNAP Systems Inc. | QuTS hero | h5.3.x ≤ v < h5.3.1.3292 build 20251024 | CVEProject cvelistV5 (CNA) |
References and advisories
1
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2025-12-16
- Last updated
- 2026-02-26
- State
- Published
- Assigner (CNA)
- qnap
Exploit prediction (EPSS)
0.63%
Probability of exploitation in 30 days
50.7%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-290