Externally-Controlled Format String Vulnerability in QNAP Operating Systems

CVE-2025-53406

What is CVE-2025-53406?

A vulnerability affecting certain QNAP operating systems allows remote attackers with administrator access to exploit an externally-controlled format string. This could lead to unauthorized access to sensitive data or alterations in memory, highlighting a significant security risk for users. The issue has been addressed in later versions of QTS and QuTS hero.

References