CVE-2025-66273 (GCVE-0-2025-66273)

Vulnerability from cvelistv5 – Published: 2026-06-10 03:04 – Updated: 2026-06-11 03:55
VLAI
Title
QTS, QuTS hero
Summary
A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following versions: QTS 5.2.9.3410 build 20260214 and later QuTS hero h5.2.9.3410 build 20260214 and later QuTS hero h5.3.4.3500 build 20260520 and later QuTS hero h6.0.0.3397 build 20260206 and later
Severity
8.6 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
Vendor Product Version
QNAP Systems Inc. QTS Affected: 5.2.0 , < 5.2.9.3410 build 20260214 (custom)
Create a notification for this product.
QNAP Systems Inc. QuTS hero Affected: h5.2.0 , < h5.2.9.3410 build 20260214 (custom)
Affected: h5.3.0 , < h5.3.4.3500 build 20260520 (custom)
Affected: ? , < h6.0.0.3397 build 20260206 (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-66273",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-11T03:55:25.759Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "QTS",
          "vendor": "QNAP Systems Inc.",
          "versions": [
            {
              "lessThan": "5.2.9.3410 build 20260214",
              "status": "affected",
              "version": "5.2.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "QuTS hero",
          "vendor": "QNAP Systems Inc.",
          "versions": [
            {
              "lessThan": "h5.2.9.3410 build 20260214",
              "status": "affected",
              "version": "h5.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "h5.3.4.3500 build 20260520",
              "status": "affected",
              "version": "h5.3.0",
              "versionType": "custom"
            },
            {
              "lessThan": "h6.0.0.3397 build 20260206",
              "status": "affected",
              "version": "?",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands.\u003cbr\u003e\u003cbr\u003eWe have already fixed the vulnerability in the following versions:\u003cbr\u003eQTS 5.2.9.3410 build 20260214 and later\u003cbr\u003eQuTS hero h5.2.9.3410 build 20260214 and later\u003cbr\u003eQuTS hero h5.3.4.3500 build 20260520 and later\u003cbr\u003eQuTS hero h6.0.0.3397 build 20260206 and later\u003cbr\u003e"
            }
          ],
          "value": "A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands.\n\nWe have already fixed the vulnerability in the following versions:\nQTS 5.2.9.3410 build 20260214 and later\nQuTS hero h5.2.9.3410 build 20260214 and later\nQuTS hero h5.3.4.3500 build 20260520 and later\nQuTS hero h6.0.0.3397 build 20260206 and later"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-88",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-88"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "exploitMaturity": "UNREPORTED",
            "privilegesRequired": "HIGH",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-10T03:04:39.973Z",
        "orgId": "2fd009eb-170a-4625-932b-17a53af1051f",
        "shortName": "qnap"
      },
      "references": [
        {
          "url": "https://www.qnap.com/en/security-advisory/qsa-26-10"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "We have already fixed the vulnerability in the following versions:\u003cbr\u003eQTS 5.2.9.3410 build 20260214 and later\u003cbr\u003eQuTS hero h5.2.9.3410 build 20260214 and later\u003cbr\u003eQuTS hero h5.3.4.3500 build 20260520 and later\u003cbr\u003eQuTS hero h6.0.0.3397 build 20260206 and later\u003cbr\u003e"
            }
          ],
          "value": "We have already fixed the vulnerability in the following versions:\nQTS 5.2.9.3410 build 20260214 and later\nQuTS hero h5.2.9.3410 build 20260214 and later\nQuTS hero h5.3.4.3500 build 20260520 and later\nQuTS hero h6.0.0.3397 build 20260206 and later"
        }
      ],
      "source": {
        "advisory": "QSA-26-10",
        "discovery": "EXTERNAL"
      },
      "title": "QTS, QuTS hero",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2fd009eb-170a-4625-932b-17a53af1051f",
    "assignerShortName": "qnap",
    "cveId": "CVE-2025-66273",
    "datePublished": "2026-06-10T03:04:39.973Z",
    "dateReserved": "2025-11-26T09:25:37.832Z",
    "dateUpdated": "2026-06-11T03:55:25.759Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-66273",
      "date": "2026-07-23",
      "epss": "0.01049",
      "percentile": "0.60679"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-66273\",\"sourceIdentifier\":\"security@qnapsecurity.com.tw\",\"published\":\"2026-06-10T04:17:12.057\",\"lastModified\":\"2026-07-23T09:10:00.113\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands.\\n\\nWe have already fixed the vulnerability in the following versions:\\nQTS 5.2.9.3410 build 20260214 and later\\nQuTS hero h5.2.9.3410 build 20260214 and later\\nQuTS hero h5.3.4.3500 build 20260520 and later\\nQuTS hero h6.0.0.3397 build 20260206 and later\"},{\"lang\":\"es\",\"value\":\"Una vulnerabilidad de inyecci\u00f3n de comandos ha sido reportada que afecta a varias versiones del sistema operativo QNAP. Si un atacante remoto obtiene una cuenta de administrador, puede entonces explotar la vulnerabilidad para ejecutar comandos arbitrarios.\\n\\nYa hemos corregido la vulnerabilidad en las siguientes versiones:\\nQTS 5.2.9.3410 build 20260214 y posteriores\\nQuTS hero h5.2.9.3410 build 20260214 y posteriores\\nQuTS hero h5.3.4.3500 build 20260520 y posteriores\\nQuTS hero h6.0.0.3397 build 20260206 y posteriores\"}],\"affected\":[{\"source\":\"security@qnapsecurity.com.tw\",\"affectedData\":[{\"vendor\":\"QNAP Systems Inc.\",\"product\":\"QTS\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"5.2.0\",\"lessThan\":\"5.2.9.3410 build 20260214\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"QNAP Systems Inc.\",\"product\":\"QuTS hero\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"h5.2.0\",\"lessThan\":\"h5.2.9.3410 build 20260214\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"h5.3.0\",\"lessThan\":\"h5.3.4.3500 build 20260520\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"?\",\"lessThan\":\"h6.0.0.3397 build 20260206\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"security@qnapsecurity.com.tw\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":8.6,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"HIGH\",\"vulnAvailabilityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.2,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-06-10T00:00:00+00:00\",\"id\":\"CVE-2025-66273\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security@qnapsecurity.com.tw\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-78\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.2.0.2737\",\"versionEndExcluding\":\"5.2.9.3410\",\"matchCriteriaId\":\"1A317C8F-BB90-4EB6-96D4-C3FC65BC0D2C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:quts_hero:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"h5.2.0.2737\",\"versionEndExcluding\":\"h5.2.9.3410\",\"matchCriteriaId\":\"6446921C-0F3B-45DC-85B3-9EA8066E726E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:quts_hero:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"h5.3.0.3115\",\"versionEndExcluding\":\"h5.3.4.3500\",\"matchCriteriaId\":\"24358BA7-15BD-439B-A17A-A62C027C68CB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:qnap:quts_hero:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"h6.0.0.3324\",\"versionEndExcluding\":\"h6.0.0.3397\",\"matchCriteriaId\":\"66E59962-660C-4947-98B2-2D5CE78FDF5F\"}]}]}],\"references\":[{\"url\":\"https://www.qnap.com/en/security-advisory/qsa-26-10\",\"source\":\"security@qnapsecurity.com.tw\",\"tags\":[\"Broken Link\",\"Vendor Advisory\"]}]}}",
    "redhat_vex": {
      "current_release_date": "2026-06-11T08:59:03+00:00",
      "cve": "CVE-2025-66273",
      "id": "CVE-2025-66273",
      "initial_release_date": "2025-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "QTS, QuTS hero",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-66273.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-66273\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-10T15:54:28.686248Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-10T15:54:33.451Z\"}}], \"cna\": {\"title\": \"QTS, QuTS hero\", \"source\": {\"advisory\": \"QSA-26-10\", \"discovery\": \"EXTERNAL\"}, \"impacts\": [{\"capecId\": \"CAPEC-88\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-88\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 8.6, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\", \"exploitMaturity\": \"UNREPORTED\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"HIGH\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"HIGH\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"QNAP Systems Inc.\", \"product\": \"QTS\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.2.0\", \"lessThan\": \"5.2.9.3410 build 20260214\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"QNAP Systems Inc.\", \"product\": \"QuTS hero\", \"versions\": [{\"status\": \"affected\", \"version\": \"h5.2.0\", \"lessThan\": \"h5.2.9.3410 build 20260214\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"h5.3.0\", \"lessThan\": \"h5.3.4.3500 build 20260520\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"?\", \"lessThan\": \"h6.0.0.3397 build 20260206\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"We have already fixed the vulnerability in the following versions:\\nQTS 5.2.9.3410 build 20260214 and later\\nQuTS hero h5.2.9.3410 build 20260214 and later\\nQuTS hero h5.3.4.3500 build 20260520 and later\\nQuTS hero h6.0.0.3397 build 20260206 and later\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"We have already fixed the vulnerability in the following versions:\u003cbr\u003eQTS 5.2.9.3410 build 20260214 and later\u003cbr\u003eQuTS hero h5.2.9.3410 build 20260214 and later\u003cbr\u003eQuTS hero h5.3.4.3500 build 20260520 and later\u003cbr\u003eQuTS hero h6.0.0.3397 build 20260206 and later\u003cbr\u003e\", \"base64\": false}]}], \"references\": [{\"url\": \"https://www.qnap.com/en/security-advisory/qsa-26-10\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.1.0-dev\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands.\\n\\nWe have already fixed the vulnerability in the following versions:\\nQTS 5.2.9.3410 build 20260214 and later\\nQuTS hero h5.2.9.3410 build 20260214 and later\\nQuTS hero h5.3.4.3500 build 20260520 and later\\nQuTS hero h6.0.0.3397 build 20260206 and later\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands.\u003cbr\u003e\u003cbr\u003eWe have already fixed the vulnerability in the following versions:\u003cbr\u003eQTS 5.2.9.3410 build 20260214 and later\u003cbr\u003eQuTS hero h5.2.9.3410 build 20260214 and later\u003cbr\u003eQuTS hero h5.3.4.3500 build 20260520 and later\u003cbr\u003eQuTS hero h6.0.0.3397 build 20260206 and later\u003cbr\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-78\", \"description\": \"CWE-78\"}]}], \"providerMetadata\": {\"orgId\": \"2fd009eb-170a-4625-932b-17a53af1051f\", \"shortName\": \"qnap\", \"dateUpdated\": \"2026-06-10T03:04:39.973Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-66273\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-06-11T03:55:25.759Z\", \"dateReserved\": \"2025-11-26T09:25:37.832Z\", \"assignerOrgId\": \"2fd009eb-170a-4625-932b-17a53af1051f\", \"datePublished\": \"2026-06-10T03:04:39.973Z\", \"assignerShortName\": \"qnap\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.