CVE-2025-30264: qnap qts +1 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2025-30264

CVSS 8.8 · High EPSS 0,91%

Kerentanan Improper Neutralization of Special Elements used in a Command ('Command Injection') pada qnap qts, qnap quts hero. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following versions: QTS 5.2.5.3145 build 20250526 and later QuTS hero h5.2.5.3138 build 20250519 and later

Rincian

Terbit di NVD: 29 Agustus 2025
Terakhir diubah: 26 September 2026
Status NVD: Analyzed
CVSS 3.1: 8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
EPSS (30 hari): 0,91% peluang dieksploitasi; lebih tinggi dari 58,8% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
qnap	qts	Versi 5.2.0.2737 build_20240417
qnap	qts	Versi 5.2.0.2744 build_20240424
qnap	qts	Versi 5.2.0.2782 build_20240601
qnap	qts	Versi 5.2.0.2802 build_20240620
qnap	qts	Versi 5.2.0.2823 build_20240711
qnap	qts	Versi 5.2.0.2851 build_20240808
qnap	qts	Versi 5.2.0.2860 build_20240817
qnap	qts	Versi 5.2.1.2930 build_20241025
qnap	qts	Versi 5.2.2.2950 build_20241114
qnap	qts	Versi 5.2.3.3006 build_20250108
qnap	qts	Versi 5.2.4.3070 build_20250312
qnap	qts	Versi 5.2.4.3079 build_20250321
qnap	qts	Versi 5.2.4.3092 build_20250403
qnap	quts hero	Versi h5.2.0.2737 build_20240417
qnap	quts hero	Versi h5.2.0.2782 build_20240601
qnap	quts hero	Versi h5.2.0.2789 build_20240607
qnap	quts hero	Versi h5.2.0.2802 build_20240620
qnap	quts hero	Versi h5.2.0.2823 build_20240711
qnap	quts hero	Versi h5.2.0.2851 build_20240808
qnap	quts hero	Versi h5.2.0.2860 build_20240817
qnap	quts hero	Versi h5.2.1.2929 build_20241025
qnap	quts hero	Versi h5.2.1.2940 build_20241105
qnap	quts hero	Versi h5.2.2.2952 build_20241116
qnap	quts hero	Versi h5.2.3.3006 build_20250108
qnap	quts hero	Versi h5.2.4.3070 build_20250312
qnap	quts hero	Versi h5.2.4.3079 build_20250321

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://www.qnap.com/en/security-advisory/qsa-25-21 advisory vendor

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.