CVE-2025-59385CWE-290

CVE-2025-59385

Critical · published December 16, 2025

CVSS v3.1
9.8
EPSS
1%
Percentile
49.8
In the wild
Unconfirmed
What it is

⚡ An authentication bypass flaw means a malicious actor could waltz right past security checks! This affects several versions of QNAP's operating system. 🔥 Think of it like a hotel employee who leaves the front desk unattended, allowing anyone to slip in without a key, bypassing all checks. Just like that, attackers could access sensitive resources without proper authentication! This means a remote attacker could potentially access confidential data, manipulate system settings, or even hijack resources—essentially inviting chaos into your digital operations. That's absolutely devastating for your security posture!

Put simply

Think of it like a hotel employee who leaves the front desk unattended, allowing anyone to slip in without a key, bypassing all checks. Just like that, attackers could access sensitive resources without proper authentication! This vulnerability allows remote attackers to spoof authentication tokens, granting them unauthorized access to resources that should require proper credentials. It affects several versions of QNAP's operating system, making it easier for attackers to exploit.

What to do

This means a remote attacker could potentially access confidential data, manipulate system settings, or even hijack resources—essentially inviting chaos into your digital operations. That's absolutely devastating for your security posture! To safeguard your system, immediately upgrade to QTS 5.2.7.3297 (build 20251024) or later. If you're using QuTS hero, ensure you update to version h5.2.7.3297 or h5.3.1.3292 (both build 20251024 or later). Check your devices today and patch up! You've got this! By following these steps, you'll bolster your defenses and keep those pesky attackers at bay! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00636 · 49.8th percentile
Weakness
CWE-290 · Authentication Bypass by Spoofing
Published
2025-12-16T08:15Z
Affected products (37)
ProductVersionsFixed in
qnap/qtsall versions—
qnap/qtsall versions—
qnap/qtsall versions—
qnap/qtsall versions—
qnap/qtsall versions—
qnap/qtsall versions—
qnap/qtsall versions—
qnap/qtsall versions—
qnap/qtsall versions—
qnap/qtsall versions—
qnap/qtsall versions—
qnap/qtsall versions—
qnap/qtsall versions—
qnap/qtsall versions—
qnap/qtsall versions—
qnap/qtsall versions—
qnap/qtsall versions—
qnap/quts_heroall versions—
qnap/quts_heroall versions—
qnap/quts_heroall versions—
qnap/quts_heroall versions—
qnap/quts_heroall versions—
qnap/quts_heroall versions—
qnap/quts_heroall versions—
qnap/quts_heroall versions—
qnap/quts_heroall versions—
qnap/quts_heroall versions—
qnap/quts_heroall versions—
qnap/quts_heroall versions—
qnap/quts_heroall versions—
qnap/quts_heroall versions—
qnap/quts_heroall versions—
qnap/quts_heroall versions—
qnap/quts_heroall versions—
qnap/quts_heroall versions—
qnap/quts_heroall versions—
qnap/quts_heroall versions—
References (1)
EPSS history
Timeline
  • 16 DEC 02:25Z
    QTS, QuTS hero
    cvelistv5