QNAP has warned customers of security flaw (CVE-2025-62847, CVE-2025-62848, CVE-2025-62849) in some of their products. A malicious actor could exploit some of these vulnerabilities to trigger remote code execution and elevation of privilege on the targeted system.

The vulnerability currently affects the following QNAP products - QTS 5.2.x series, the QuTS hero h5.2.x series, and the QuTS hero h5.3.x series. Vulnerabilities were fixed in versions QTS 5.2.7.3297 build 20251024, QuTS hero h5.2.7.3297 build 20251024 and QuTS hero h5.3.1.3292 build 20251024.

More information on vulnerability and updates is available in QNAP security advisory – qnap.com