CVE-2025-62848CWE-476

CVE-2025-62848

High · published December 16, 2025

CVSS v3.1
7.5
EPSS
1%
Percentile
58.2
In the wild
Unconfirmed
What it is

⚡ A sneaky NULL pointer dereference could put your QNAP systems in a tailspin! Think of it like a power outage in a busy restaurant — everything grinds to a halt because the kitchen can't operate without electricity. A denial-of-service (DoS) attack triggered by this vulnerability can leave your system unresponsive, just like diners waiting for their meals in the dark! An attacker can exploit this vulnerability to initiate a denial-of-service attack, causing your systems to become completely unresponsive. Imagine your data center under siege, with legitimate requests getting left in the lurch. This could disrupt operations and lead to significant downtime, impacting productivity and service delivery.

Put simply

Think of it like a power outage in a busy restaurant — everything grinds to a halt because the kitchen can't operate without electricity. A denial-of-service (DoS) attack triggered by this vulnerability can leave your system unresponsive, just like diners waiting for their meals in the dark! This NULL pointer dereference vulnerability in several QNAP operating system versions allows remote attackers to crash the system, resulting in a denial-of-service condition. Essentially, the flaw occurs when the system attempts to use a null reference, leading to failure in execution.

What to do

An attacker can exploit this vulnerability to initiate a denial-of-service attack, causing your systems to become completely unresponsive. Imagine your data center under siege, with legitimate requests getting left in the lurch. This could disrupt operations and lead to significant downtime, impacting productivity and service delivery. To protect your systems, upgrade to QTS 5.2.7.3297 build 20251024 or later, or QuTS hero h5.2.7.3297 build 20251024 and later. Ensuring you’re on the latest version is crucial for keeping your systems healthy and functional. Don't wait—patch it up ASAP! You've got this! Keep your systems secure by following these steps and let the good times roll! 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00862 · 58.2th percentile
Weakness
CWE-476 · NULL Pointer Dereference
Published
2025-12-16T08:15Z
Affected products (37)
ProductVersionsFixed in
qnap/qtsall versions—
qnap/qtsall versions—
qnap/qtsall versions—
qnap/qtsall versions—
qnap/qtsall versions—
qnap/qtsall versions—
qnap/qtsall versions—
qnap/qtsall versions—
qnap/qtsall versions—
qnap/qtsall versions—
qnap/qtsall versions—
qnap/qtsall versions—
qnap/qtsall versions—
qnap/qtsall versions—
qnap/qtsall versions—
qnap/qtsall versions—
qnap/qtsall versions—
qnap/quts_heroall versions—
qnap/quts_heroall versions—
qnap/quts_heroall versions—
qnap/quts_heroall versions—
qnap/quts_heroall versions—
qnap/quts_heroall versions—
qnap/quts_heroall versions—
qnap/quts_heroall versions—
qnap/quts_heroall versions—
qnap/quts_heroall versions—
qnap/quts_heroall versions—
qnap/quts_heroall versions—
qnap/quts_heroall versions—
qnap/quts_heroall versions—
qnap/quts_heroall versions—
qnap/quts_heroall versions—
qnap/quts_heroall versions—
qnap/quts_heroall versions—
qnap/quts_heroall versions—
qnap/quts_heroall versions—
References (1)
EPSS history
Timeline
  • 16 DEC 02:25Z
    QTS, QuTS hero
    cvelistv5