CVE-2025-30264: QTS, QuTS hero

Vulnerability summary

CVE-2025-30264 is a high (CVSS 8.8) Command Injection vulnerability in qnap systems inc. qts. EPSS estimates a 0.91% chance of exploitation in the next 30 days, higher than 59.5% of scored vulnerabilities.

Timeline

1. 29-08-2025
   PublishedVulnerability first disclosed.
2. 26-02-2026
   Last modifiedVulnerability information updated.

Description

A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following versions: QTS 5.2.5.3145 build 20250526 and later QuTS hero h5.2.5.3138 build 20250519 and later

• CWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
• CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.