NULL Pointer Dereference in QNAP Operating System
CVE-2025-30268

5.3MEDIUM

Key Information:

Vendor

QNAP
Status
Qts
Quts Hero
Vendor
CVE Published:
29 August 2025

What is CVE-2025-30268?

A NULL pointer dereference vulnerability exists in several versions of the QNAP operating system. If an attacker obtains a user account, they can exploit this vulnerability to execute a denial-of-service (DoS) attack, potentially leading to system instability or unavailability. Updated versions addressing this vulnerability include QTS 5.2.5.3145 build 20250526 and QuTS hero h5.2.5.3138 build 20250519.

Affected Version(s)

QTS 5.2.x < 5.2.5.3145 build 20250526

QuTS hero h5.2.x

References

https://www.qnap.com/en/security-advisory/qsa-25-21

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

coral
.
CVE-2025-30268 : NULL Pointer Dereference in QNAP Operating System