ZeroDay Findings
Sign inSign up

Findings

CVE-2025-53590

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions.

Published Jan 2, 2026 · updated Oct 14, 2026 · qnap quts hero

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: QTS 5.2.7.3256 build 20250913 and later

Timeline

Detection, updates, and resolution for this record.

  1. Jan 2, 2026 · NIST NVD

    Detected

    A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: QTS 5.2.7.3256 build 20250913 and later

  2. Oct 14, 2026 · NIST NVD

    Updated

    A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: QTS 5.2.7.3256 build 20250913 and later

Affected

  • cpe qnap/qts5.2.0.2737
  • cpe qnap/quts heroh5.2.0.2737
  • cpe qnap/quts heroh5.2.0.2782
  • cpe qnap/quts heroh5.2.0.2789
  • cpe qnap/quts heroh5.2.0.2802
  • cpe qnap/quts heroh5.2.0.2823
  • cpe qnap/quts heroh5.2.0.2851
  • cpe qnap/quts heroh5.2.0.2860
  • cpe qnap/quts heroh5.2.1.2929

Sources

  • CVE.orgCVE-2025-53590

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2025-53590

    30-day exploitation probability 0.4%

    first.org
  • NIST NVDCVE-2025-53590

    A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnera

    nvd.nist.gov

References