QNAP QTS <=5.2.8.3332 NULL PTR DoS Vulnerability
CVE-2025-47205 Published on February 11, 2026

QTS, QuTS hero
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QTS 5.2.8.3332 build 20251128 and later QuTS hero h5.2.8.3321 build 20251117 and later

NVD

Vulnerability Analysis

CVE-2025-47205 can be exploited with network access, and requires user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.

Exploitation:

NONE

Automatable:

NO

Technical Impact:

PARTIAL

Attack Vector:

NETWORK

Attack Complexity:

LOW

Privileges Required:

HIGH

User Interaction:

NONE

Weakness Type

NULL Pointer Dereference

A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit. NULL pointer dereference issues can occur through a number of flaws, including race conditions, and simple programming omissions.

Products Associated with CVE-2025-47205

stack.watch emails you whenever new vulnerabilities are published in QNAP Qts or QNAP Quts Hero. Just hit a watch button to start following.

QNAP Qts

  Watch

QNAP Quts Hero

  Watch

Affected Versions

• Version 5.2.x and below 5.2.8.3332 build 20251128 is affected.

• Version h5.2.x and below h5.2.8.3321 build 20251117 is affected.

Exploit Probability