A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If can then exploit the vulnerability to launch a denial-of-service (DoS) attack.
We have already fixed the vulnerability in the following versions:
QTS 5.2.5.3145 build 20250526 and later
QuTS hero h5.2.5.3138 build 20250519 and later
References
| Link | Resource |
|---|---|
| https://www.qnap.com/en/security-advisory/qsa-25-21 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
History
22 Sep 2025, 14:37
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Qnap
Qnap qts Qnap quts Hero |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
| References | () https://www.qnap.com/en/security-advisory/qsa-25-21 - Vendor Advisory | |
| CPE | cpe:2.3:o:qnap:quts_hero:h5.2.2.2952:build_20241116:*:*:*:*:*:* cpe:2.3:o:qnap:quts_hero:h5.2.4.3079:build_20250321:*:*:*:*:*:* cpe:2.3:o:qnap:qts:5.2.0.2744:build_20240424:*:*:*:*:*:* cpe:2.3:o:qnap:qts:5.2.4.3079:build_20250321:*:*:*:*:*:* cpe:2.3:o:qnap:qts:5.2.0.2823:build_20240711:*:*:*:*:*:* cpe:2.3:o:qnap:qts:5.2.0.2860:build_20240817:*:*:*:*:*:* cpe:2.3:o:qnap:quts_hero:h5.2.0.2782:build_20240601:*:*:*:*:*:* cpe:2.3:o:qnap:qts:5.2.0.2851:build_20240808:*:*:*:*:*:* cpe:2.3:o:qnap:quts_hero:h5.2.0.2851:build_20240808:*:*:*:*:*:* cpe:2.3:o:qnap:quts_hero:h5.2.4.3070:build_20250312:*:*:*:*:*:* cpe:2.3:o:qnap:quts_hero:h5.2.0.2802:build_20240620:*:*:*:*:*:* cpe:2.3:o:qnap:qts:5.2.4.3070:build_20250312:*:*:*:*:*:* cpe:2.3:o:qnap:qts:5.2.2.2950:build_20241114:*:*:*:*:*:* cpe:2.3:o:qnap:quts_hero:h5.2.1.2940:build_20241105:*:*:*:*:*:* cpe:2.3:o:qnap:quts_hero:h5.2.0.2737:build_20240417:*:*:*:*:*:* cpe:2.3:o:qnap:quts_hero:h5.2.0.2860:build_20240817:*:*:*:*:*:* cpe:2.3:o:qnap:quts_hero:h5.2.0.2789:build_20240607:*:*:*:*:*:* cpe:2.3:o:qnap:qts:5.2.0.2782:build_20240601:*:*:*:*:*:* cpe:2.3:o:qnap:qts:5.2.4.3092:build_20250403:*:*:*:*:*:* cpe:2.3:o:qnap:qts:5.2.0.2737:build_20240417:*:*:*:*:*:* cpe:2.3:o:qnap:quts_hero:h5.2.1.2929:build_20241025:*:*:*:*:*:* cpe:2.3:o:qnap:qts:5.2.3.3006:build_20250108:*:*:*:*:*:* cpe:2.3:o:qnap:quts_hero:h5.2.3.3006:build_20250108:*:*:*:*:*:* cpe:2.3:o:qnap:quts_hero:h5.2.0.2823:build_20240711:*:*:*:*:*:* cpe:2.3:o:qnap:qts:5.2.0.2802:build_20240620:*:*:*:*:*:* cpe:2.3:o:qnap:qts:5.2.1.2930:build_20241025:*:*:*:*:*:* |
29 Aug 2025, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-08-29 18:15
Updated : 2025-09-22 14:37
NVD link : CVE-2025-30274
Mitre link : CVE-2025-30274
CVE.ORG link : CVE-2025-30274
JSON object : View
Products Affected
qnap
- qts
- quts_hero
CWE
CWE-476
NULL Pointer Dereference