CVE-2025-9110CWE-497

CVE-2025-9110

High Β· published January 2, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
38.3
In the wild
Unconfirmed
What it is

⚠️ An unauthorized control sphere can peek into your system! This vulnerability lets remote attackers read application data from several QNAP operating systemsβ€”yikes! 😱 Think of it like a restaurant with a glass kitchen. While you can see the chefs at work, an unauthorized guest could also catch a glimpse of the recipe book, exposing secret ingredients. 🍽️ While this isn't a catastrophic breach, it means that sensitive application data could potentially be exposed. An attacker could gather useful information about your system, which could lead to more serious issues down the line. Let's not give them a leg up!

Put simply

Think of it like a restaurant with a glass kitchen. While you can see the chefs at work, an unauthorized guest could also catch a glimpse of the recipe book, exposing secret ingredients. 🍽️ This vulnerability allows unauthorized access to sensitive system information, exposing application data on affected QNAP OS versions. Remote attackers can exploit this oversight to gather information without needing authentication.

What to do

While this isn't a catastrophic breach, it means that sensitive application data could potentially be exposed. An attacker could gather useful information about your system, which could lead to more serious issues down the line. Let's not give them a leg up! To protect your systems, upgrade to QTS 5.2.8.3332 build 20251128 or later, or QuTS hero h5.2.8.3321 build 20251117 and later. Regularly check for updates and ensure your systems are always running the latest versions to avoid vulnerabilities! πŸ›‘οΈ You've got this! Staying informed and proactive about updates is the key to keeping your data safe. πŸ¦Έβ€β™‚οΈ

The record
Technical detail
CVSS v3.1
7.5 Β· HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00453 Β· 38.3th percentile
Weakness
CWE-497 Β· Exposure of Sensitive System Information to an Unauthorized Control Sphere
Published
2026-01-02T21:17Z
Affected products (38)
ProductVersionsFixed in
qnap/qtsall versionsβ€”
qnap/qtsall versionsβ€”
qnap/qtsall versionsβ€”
qnap/qtsall versionsβ€”
qnap/qtsall versionsβ€”
qnap/qtsall versionsβ€”
qnap/qtsall versionsβ€”
qnap/qtsall versionsβ€”
qnap/qtsall versionsβ€”
qnap/qtsall versionsβ€”
qnap/qtsall versionsβ€”
qnap/qtsall versionsβ€”
qnap/qtsall versionsβ€”
qnap/qtsall versionsβ€”
qnap/qtsall versionsβ€”
qnap/qtsall versionsβ€”
qnap/qtsall versionsβ€”
qnap/qtsall versionsβ€”
qnap/quts_heroall versionsβ€”
qnap/quts_heroall versionsβ€”
qnap/quts_heroall versionsβ€”
qnap/quts_heroall versionsβ€”
qnap/quts_heroall versionsβ€”
qnap/quts_heroall versionsβ€”
qnap/quts_heroall versionsβ€”
qnap/quts_heroall versionsβ€”
qnap/quts_heroall versionsβ€”
qnap/quts_heroall versionsβ€”
qnap/quts_heroall versionsβ€”
qnap/quts_heroall versionsβ€”
qnap/quts_heroall versionsβ€”
qnap/quts_heroall versionsβ€”
qnap/quts_heroall versionsβ€”
qnap/quts_heroall versionsβ€”
qnap/quts_heroall versionsβ€”
qnap/quts_heroall versionsβ€”
qnap/quts_heroall versionsβ€”
qnap/quts_heroall versionsβ€”
References (1)
EPSS history
Timeline
  • 02 JAN 15:17Z
    QTS, QuTS hero
    cvelistv5