CVE-2025-62850 NULL Pointer Dereference in networkRequest.cgi
Remote administrators can trigger a denial-of-service attack via a NULL pointer dereference in networkRequest.cgi on QNAP NAS operating systems.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-62850?
CVE-2025-62850 is a medium-severity vulnerability in Qnap Quts Hero, published on 10 Jun 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A NULL pointer dereference vulnerability has been reported to affect QTS, QVP, QuTS cloud and QuTS hero. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.
We have already fixed the vulnerability in the following version: QTS 5.2.9.3410 build 20260214 and later QVP 2.7.4 and later QuTS cloud c5.2.9.3468 build 20260413 and later QuTS hero h5.2.9.3410 build 20260214 and later QuTS hero h5.3.4.3500 build 20260520 and later QuTS hero h6.0.0.3459 build 20260409 and later
Weakness: CWE-476
Which versions are affected by CVE-2025-62850?
It affects 1 product.
Products include Qnap Quts Hero.
How do I fix CVE-2025-62850?
No fix has been published for CVE-2025-62850 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-62850 being exploited?
There is no known exploitation of CVE-2025-62850 in the wild and no public exploit code.
Other vulnerabilities in Qnap Quts Hero
Sources
Also known as GHSA-53hc-rhp5-vgx7.