dbcve.org
QtsOperating system · Qnap

CVE-2025-66280

HIGH · 7.2 CVSS v3.1 Published 2026-06-10
Fix available
A fix is available. Upgrade to 5.2.9.3410 or later.
See remediation →
78/100
Remediation priority · High
Remotely reachable Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
An integer overflow or wraparound vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following versions: QTS 5.2.9.3410 build 20260214 and later QuTS hero h5.2.9.3410 build 20260214 and later QuTS hero h5.3.4.3500 build 20260520 and later QuTS hero h6.0.0.3397 build 20260206 and later

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

An integer overflow or wraparound vulnerability in QNAP QTS and QuTS hero operating systems. The flaw allows a remote attacker who has already obtained administrator credentials to exploit the overflow and compromise system security. The vulnerability is patched in specific firmware builds released in early 2026.

MitigationApply the appropriate firmware update (QTS 5.2.9.3410 build 20260214+, QuTS hero h5.2.9.3410 build 20260214+, h5.3.4.3500 build 20260520+, or h6.0.0.3397 build 20260206+) after verifying system compatibility and scheduling maintenance window.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
QtsOperating system
Affected:>= 5.2.0.2737, < 5.2.9.3410
Quts HeroOperating system
Affected:>= h5.2.0.2737, < h5.2.9.3410>= h5.3.0.3115, < h5.3.4.3500>= h6.0.0.3324, < h6.0.0.3397

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify the QNAP product type
    Access the QNAP admin interface and check System Information > System Name, or run 'lsid' command via SSH to determine if the device runs QTS or QuTS hero
    Affected if The device is running QNAP QTS or QuTS hero firmware
  2. Check installed firmware version in QTS
    In QTS admin interface go to Control Panel > System > System Information > Firmware Version, or run 'getsysinfo sys firmware' via SSH. Compare the version number to the affected range >= 5.2.0.2737 and < 5.2.9.3410
    Affected if Version falls within 5.2.0.2737 to 5.2.9.3409 inclusive
  3. Check installed firmware version in QuTS hero
    In QuTS hero admin interface go to Control Panel > System > System Information > Firmware Version, or run 'getsysinfo sys firmware' via SSH. Compare version against affected ranges: >= h5.2.0.2737 and < h5.2.9.3410; OR >= h5.3.0.3115 and < h5.3.4.3500; OR >= h6.0.0.3324 and < h6.0.0.3397
    Affected if Version falls within any of the three QuTS hero affected ranges
  4. Verify administrator credential security
    Review administrator accounts in Control Panel > System > Admin Security. Check for weak passwords, unused admin accounts, or exposure to untrusted networks. Audit /etc/config/smb.conf for any unauthorized admin-level shares
    Affected if Administrator credentials are weak, shared, or administrative interface is accessible from untrusted networks (internet-facing)
  5. Assess administrative network exposure
    Check router/firewall rules that forward traffic to the QNAP device on ports 443, 8080, 8081, or 22. Review QNAP myQNAPcloud service settings for any port forwarding enabled
    Affected if Administrative interface (HTTPS/web or SSH) is exposed directly to the internet without VPN or IP allowlist

The environment is affected if the QNAP device runs QTS version 5.2.0.2737-5.2.9.3409 or QuTS hero version h5.2.0.2737-h5.2.9.3409, h5.3.0.3115-h5.3.4.3500, or h6.0.0.3324-h6.0.0.3396 AND the attacker could obtain administrator credentials through weak passwords, credential theft, or network exposure.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Upgrade available Upgrade to 5.2.9.3410 or later
Fixed in 5.2.9.3410
Interim mitigation

Apply the appropriate firmware update (QTS 5.2.9.3410 build 20260214+, QuTS hero h5.2.9.3410 build 20260214+, h5.3.4.3500 build 20260520+, or h6.0.0.3397 build 20260206+) after verifying system compatibility and scheduling maintenance window.

Recommended fix High confidence

QTS 5.2.9.3410 (build 20260214) or later; QuTS hero h5.2.9.3410 (build 20260214), h5.3.4.3500 (build 20260520), or h6.0.0.3397 (build 20260206) depending on current branch

  1. 1. Identify the current QTS or QuTS hero version by accessing the QNAP admin interface and navigating to Control Panel > System > Firmware Version
  2. 2. Determine if the current version falls within the affected ranges: QTS < 5.2.9.3410, QuTS hero h5.2.x < 5.2.9.3410, QuTS hero h5.3.x < 5.3.4.3500, or QuTS hero h6.0.x < 6.0.0.3397
  3. 3. Review the QNAP firmware upgrade documentation and ensure adequate backup of critical data
  4. 4. Access Control Panel > System > Firmware Update or use the Qfinder Pro tool to perform the update
  5. 5. For QTS: upgrade to version 5.2.9.3410 build 20260214 or later
  6. 6. For QuTS hero h5.2.x: upgrade to version h5.2.9.3410 build 20260214 or later
  7. 7. For QuTS hero h5.3.x: upgrade to version h5.3.4.3500 build 20260520 or later
  8. 8. For QuTS hero h6.0.x: upgrade to version h6.0.0.3397 build 20260206 or later
Caveat Review QNAP release notes for any app compatibility or configuration changes between current and target versions before upgrading

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Qts Scoped from the published advisory
  • Consultation4.0 h
  • Implementation2.0 h
  • Testing3.0 h
  • Review / QA2.0 h
11.0 hours of engineering $1,970
Get the upgrade done

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $3,152.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2025-66280 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2025-66280 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data