CVE-2025-62849 Details
Description
An SQL injection vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following versions: QTS 5.2.7.3297 build 20251024 and later QuTS hero h5.2.7.3297 build 20251024 and later QuTS hero h5.3.1.3292 build 20251024 and later
A SQL injection vulnerability has been identified in multiple QNAP operating system versions. This vulnerability allows remote attackers to execute unauthorized code or commands on the affected system. The issue has been addressed in QTS 5.2.7.3297 build 20251024 and later, as well as in QuTS hero h5.2.7.3297 build 20251024 and h5.3.1.3292 build 20251024.
Users can upgrade to QTS 5.2.7.3297 build 20251024 or later, or to QuTS hero h5.2.7.3297 build 20251024 or h5.3.1.3292 build 20251024.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Dec 17, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.qnap.com/en/security-advisory/qsa-25-45 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| qnap qts | 5.2.0.2737 build_20240417 5.2.0.2744 build_20240424 5.2.0.2782 build_20240601 5.2.0.2802 build_20240620 5.2.0.2823 build_20240711 5.2.0.2851 build_20240808 5.2.0.2860 build_20240817 5.2.1.2930 build_20241025 5.2.2.2950 build_20241114 5.2.3.3006 build_20250108 5.2.4.3070 build_20250312 5.2.4.3079 build_20250321 5.2.4.3092 build_20250403 5.2.5.3145 build_20250526 5.2.6.3195 build_20250715 5.2.6.3229 build_20250818 5.2.7.3256 build_20250913 |
CPE
Remediation
| |
| qnap quts hero | h5.2.0.2737 build_20240417 h5.2.0.2782 build_20240601 h5.2.0.2789 build_20240607 h5.2.0.2802 build_20240620 h5.2.0.2823 build_20240711 h5.2.0.2851 build_20240808 h5.2.0.2860 build_20240817 h5.2.1.2929 build_20241025 h5.2.1.2940 build_20241105 h5.2.2.2952 build_20241116 h5.2.3.3006 build_20250108 h5.2.4.3070 build_20250312 h5.2.4.3079 build_20250321 h5.2.5.3138 build_20250519 h5.2.6.3195 build_20250715 h5.2.7.3256 build_20250913 h5.3.0.3115 build_20250430 h5.3.0.3145 build_20250530 h5.3.0.3192 build_20250716 h5.3.1.3250 build_20250912 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Dec 17, 2025 | Initial Analysis | [email protected] |
| Dec 16, 2025 | New CVE Received | [email protected] |