CVE-2025-66273
A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to...
Affects 0 products across 1 vendor.
Attacker injects OS commands through application inputs passed to system() or equivalent calls, leading to arbitrary command execution.
CVE-2025-66273 is a post-authentication command injection vulnerability affecting multiple QNAP NAS operating system versions (QTS and QuTS hero). An attacker who has obtained or compromised an administrator account can execute arbitrary OS-level commands on the affected device. In OT environments where QNAP NAS devices are used for historian data storage, backup, or file sharing, successful exploitation could result in data exfiltration, ransomware deployment, or lateral movement into control system networks.
Is this CVE in your environment?
BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.
Check My Environment →What is CVE-2025-66273?
Is CVE-2025-66273 actively exploited?
How do I remediate CVE-2025-66273?
What systems are affected by CVE-2025-66273?
| CVE ID | CVE-2025-66273 |
|---|---|
| Published | 2026-06-10 |
| Last Modified | 2026-06-10 |
| ICS Relevance | 70% |
| Weakness (CWE) | |
| Source | NVD |
A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following versions: QTS 5.2.9.3410 build 20260214 and later QuTS hero h5.2.9.3410 build 20260214 and later QuTS hero h5.3.4.3500 build 20260520 and later QuTS hero h6.0.0.3397 build 20260206 and later
Source: NIST NVD / MITRE CVE Database
| Vendor | Product | Fixed Version |
|---|---|---|
| Qnap | — | — |
Fixed Version: QTS 5.2.9.3410 build 20260214; QuTS hero h5.2.9.3410 build 20260214; QuTS hero h5.3.4.3500 build 20260520; QuTS hero h6.0.0.3397 build 20260206
Patches remediate command injection in affected QNAP QTS and QuTS hero OS versions by fixing improper handling of attacker-controlled input that could reach OS command execution interfaces when accessed by an authenticated administrator.
View Vendor Advisory →| CISA KEV | Not in KEV catalog |
|---|---|
| Public Exploit | Not confirmed |
| PoC Code | Not confirmed |
Deploy rule at perimeter firewalls and OT DMZ inspection points. Block all inbound HTTP/HTTPS access to QNAP management interfaces (default ports 80, 443, 8080) from untrusted zones. Allow only traffic from dedicated management VLAN subnets. Additionally, block outbound connections from QNAP devices to the internet at the OT network boundary to limit post-exploitation impact.
No reliable network detection signature exists for this vulnerability class — apply the compensating controls above and the vendor patch. SAGE only publishes a network rule when a concrete on-the-wire signature can be grounded in the advisory.
Virtual patch generated by CITED Relevance SAGE. Validate in isolated environment before production deployment. Compensating control only - does not replace vendor patch.
ICS/OT Vulnerability Intelligence for Your Environment
BreachSpider monitors 353,228 CVEs across ICS/OT vendors. SAGE-enriched alerts with virtual patches, NERC-CIP mapping, and PSIRT contacts delivered to your SIEM in minutes.
Join free →