CVE-2025-66280
An integer overflow or wraparound vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vu...
Affects 0 products across 1 vendor.
Buffer overflow corrupting the program stack, typically overwriting the return address for code execution.
Arithmetic operation exceeds the maximum integer value, wrapping around and often leading to undersized allocations.
QNAP network-attached storage (NAS) devices running QTS and QuTS hero operating systems are affected by an integer overflow vulnerability that can be exploited by an attacker who has already obtained administrator-level access. Successful exploitation allows the attacker to further compromise system integrity, potentially enabling full system takeover, data exfiltration, or use of the NAS as a pivot point into OT network segments. In OT environments where QNAP NAS devices are commonly used for historian data storage, backups, or engineering file repositories, this vulnerability poses a meaningful risk to operational data confidentiality and availability.
Is this CVE in your environment?
BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.
Check My Environment →What is CVE-2025-66280?
Is CVE-2025-66280 actively exploited?
How do I remediate CVE-2025-66280?
What systems are affected by CVE-2025-66280?
| CVE ID | CVE-2025-66280 |
|---|---|
| Published | 2026-06-10 |
| Last Modified | 2026-06-10 |
| ICS Relevance | 70% |
| Weakness (CWE) | |
| Source | NVD |
An integer overflow or wraparound vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following versions: QTS 5.2.9.3410 build 20260214 and later QuTS hero h5.2.9.3410 build 20260214 and later QuTS hero h5.3.4.3500 build 20260520 and later QuTS hero h6.0.0.3397 build 20260206 and later
Source: NIST NVD / MITRE CVE Database
| Vendor | Product | Fixed Version |
|---|---|---|
| Qnap | — | — |
Fixed Version: QTS 5.2.9.3410 build 20260214; QuTS hero h5.2.9.3410 build 20260214; QuTS hero h5.3.4.3500 build 20260520; QuTS hero h6.0.0.3397 build 20260206
Vendor-released firmware updates for QTS and QuTS hero that remediate an integer overflow or wraparound condition exploitable by authenticated administrator-level remote attackers. Updates apply across multiple active firmware branches to ensure broad coverage of deployed device versions.
View Vendor Advisory →| CISA KEV | Not in KEV catalog |
|---|---|
| Public Exploit | Not confirmed |
| PoC Code | Not confirmed |
Deploy rules on perimeter and OT DMZ firewalls/IDS to monitor and alert on high-frequency POST requests targeting QNAP management CGI endpoints from external or untrusted network segments. Block all inbound connections to QNAP management ports (8080, 443, 22) from any source outside the designated management VLAN. Enforce allowlisting of administrator source IPs at the network boundary. These rules should be deployed on the firewall or IDS sitting between the IT/internet zone and the OT/NAS segment.
No reliable network detection signature exists for this vulnerability class — apply the compensating controls above and the vendor patch. SAGE only publishes a network rule when a concrete on-the-wire signature can be grounded in the advisory.
Virtual patch generated by CITED Relevance SAGE. Validate in isolated environment before production deployment. Compensating control only - does not replace vendor patch.
ICS/OT Vulnerability Intelligence for Your Environment
BreachSpider monitors 353,228 CVEs across ICS/OT vendors. SAGE-enriched alerts with virtual patches, NERC-CIP mapping, and PSIRT contacts delivered to your SIEM in minutes.
Join free →