PT-2026-48360 · Qnap · Qts+1
CVE-2025-66273
·
Published
2026-06-10
·
Updated
2026-06-10
CVSS v4.0
8.6
High
| Vector | AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
QTS versions prior to 5.2.9.3410 build 20260214
QuTS hero versions prior to h5.2.9.3410 build 20260214
QuTS hero versions prior to h5.3.4.3500 build 20260520
QuTS hero versions prior to h6.0.0.3397 build 20260206
Description
A command injection issue exists where a remote attacker with administrator account access can execute arbitrary commands on the system.
Recommendations
Update QTS to version 5.2.9.3410 build 20260214 or later.
Update QuTS hero to version h5.2.9.3410 build 20260214 or later.
Update QuTS hero to version h5.3.4.3500 build 20260520 or later.
Update QuTS hero to version h6.0.0.3397 build 20260206 or later.
Fix
OS Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Qts
Quts Hero