QNAP security advisories, August 2025

Every QNAP security advisory published in August 2025, from QNAP PSIRT ([email protected] CNA) via NVD, with its severity, CVEs and CISA KEV status. Open a record for affected and fixed versions and the vendor's own link.

Advisories: 25
Critical: 1
High: 7
In CISA KEV: 0
CVEs: 25

QNAP advisories published in August 2025

Aug 29, 2025
Critical [CVE-2025-52856] improper authentication vulnerability has been reported to affect VioStor.
Critical9.8
Aug 29, 2025
High [CVE-2025-44015] command injection vulnerability has been reported to affect HybridDesk Station.
High8.4
Aug 29, 2025
High [CVE-2025-30278] Qsync: improper certificate validation vulnerability has been reported to affect Qsync Central.
High8.8
Aug 29, 2025
High [CVE-2025-30273] QTS: out-of-bounds write vulnerability has been reported to affect several QNAP operating system versions.
High8.1
Aug 29, 2025
High [CVE-2025-30264] QTS: command injection vulnerability has been reported to affect several QNAP operating system versions.
High8.8
Aug 29, 2025
High [CVE-2025-29894] Qsync: SQL injection vulnerability has been reported to affect Qsync Central.
High8.8
Aug 29, 2025
High [CVE-2025-29887] command injection vulnerability has been reported to affect QuRouter 2.5.1.
High7.2
Aug 29, 2025
Medium [CVE-2025-33038] Qsync: path traversal vulnerability has been reported to affect Qsync Central.
Medium6.5
Aug 29, 2025
Medium [CVE-2025-33032] QTS: path traversal vulnerability has been reported to affect several QNAP operating system versions.
Medium4.9
Aug 29, 2025
Medium [CVE-2025-30275] Qsync: NULL pointer dereference vulnerability has been reported to affect Qsync Central.
Medium6.5
Aug 29, 2025
Medium [CVE-2025-30274] QTS: NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions.
Medium6.5
Aug 29, 2025
Medium [CVE-2025-30271] QTS: path traversal vulnerability has been reported to affect several QNAP operating system versions.
Medium6.5
Aug 29, 2025
Medium [CVE-2025-30268] QTS: NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions.
Medium6.5
Aug 29, 2025
Medium [CVE-2025-30265] QTS: buffer overflow vulnerability has been reported to affect several QNAP operating system versions.
Medium6.5
Aug 29, 2025
Medium [CVE-2025-30263] Qsync: NULL pointer dereference vulnerability has been reported to affect Qsync Central.
Medium6.5
Aug 29, 2025
Medium [CVE-2025-30261] Qsync: allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central.
Medium6.5
Aug 29, 2025
Medium [CVE-2025-30260] Qsync: allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central.
Medium6.5
Aug 29, 2025
Medium [CVE-2025-29900] allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5.
Medium6.5
Aug 29, 2025
Medium [CVE-2025-29898] Qsync: uncontrolled resource consumption vulnerability has been reported to affect Qsync Central.
Medium6.5
Aug 29, 2025
Medium [CVE-2025-29889] NULL pointer dereference vulnerability has been reported to affect File Station 5.
Medium6.5
Aug 29, 2025
Medium [CVE-2025-22483] License Center: cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions.
Medium4.8
Aug 29, 2025
Medium [CVE-2024-12923] Photo Station: cross-site scripting (XSS) vulnerability has been reported to affect Photo Station.
Medium5.4
Aug 29, 2025
Advisory [CVE-2025-52861] path traversal vulnerability has been reported to affect VioStor.
Unrated
Aug 26, 2025
Medium [CVE-2025-29901] NULL pointer dereference vulnerability has been reported to affect File Station 5.
Medium6.5
Aug 18, 2025
High [CVE-2025-47206] out-of-bounds write vulnerability has been reported to affect File Station 5.
High8.1

Get an email when QNAP publishes the next one.

See QNAP's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).

Alert me about QNAP

Dates are each advisory's publication date at the source, in UTC; a record with no source date is filed under the day VulniPulse first saw it.