A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administra…

cve CVE-2025-62852 1 source, 1 claim · Watch

NVD writes:
A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following version: QTS 5.2.8.3332 build 20251128 and later the claim

Severity: MEDIUM NVD
CVSS: 6.5 NVD
Vendor: QNAP Systems Inc. NVD
Product: QTS NVD
CWE: CWE-121, CWE-787 NVD

How far exploitation has got

No public code known
Proof of concept
Proof of concept, verified
A Metasploit module
Exploited in the wild
Used in ransomware campaigns

Timeline

2026-01-02

first spoke of it: A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following version: QTS 5.2.8.3332 build 20251128 and later

NVD

A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following version: QTS 5.2.8.3332 build 20251128 and later

What it is to other things

affects	qnap/qts NVD
affects	qnap/quts_hero NVD
made_by	qnap NVD

In words only, so not counted until a person confirms one:

made_by	`qnap_systems_inc` NVD says “QNAP Systems Inc.”
affects	`qnap_systems_inc/qts` NVD says “QNAP Systems Inc. · QTS”

Every value, with what each source said and its receipt

Property Source Said Means here

Automatable

automatable

NVD

At least one of those steps needs a person.

receipt

Source: NVD
Its words: no
Read by: field:cve.metrics.ssvcV203[].ssvcData.options[].automatable
Said since: 2026-10-06 12:29 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-10-06 12:29 UTC	no
2026-10-02 12:00 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "QTS",
            "vendor": "QNAP Systems Inc.",
            "versions": [
              {
                "lessThan": "5.2.8.3332 build 20251128",
                "status": "affected",
                "version": "5.2.x",
                "versionType": "custom"
              }
            ]
          }
        ],
        "source": "security@qnapsecurity.com.tw"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2737:build_20240417:*:*:*:*:*:*",
                "matchCriteriaId": "F4026A4B-7AB4-48EA-971D-88DFDD3F01A7",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2744:build_20240424:*:*:*:*:*:*",
                "matchCriteriaId": "1F3F99BB-0D68-4D74-92C8-59E24F96C50D",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2782:build_20240601:*:*:*:*:*:*",
                "matchCriteriaId": "1DE63B4D-8E84-41D3-B1F3-04AE6040242B",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2802:build_20240620:*:*:*:*:*:*",
                "matchCriteriaId": "75746563-C648-4E55-9126-703F915F8B8A",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2823:build_20240711:*:*:*:*:*:*",
                "matchCriteriaId": "AF6BA027-A635-4E90-80C8-130B10AB3D23",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2851:build_20240808:*:*:*:*:*:*",
                "matchCriteriaId": "5406F242-A215-4B07-809F-7A7CE55ACE71",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2860:build_20240817:*:*:*:*:*:*",
                "matchCriteriaId": "FA17778E-B3B1-44DD-B4E9-5AD25A3E804C",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.1.2930:build_20241025:*:*:*:*:*:*",
                "matchCriteriaId": "E3FC6646-2247-4ED9-9643-CD376674E2E7",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.2.2950:build_20241114:*:*:*:*:*:*",
                "matchCriteriaId": "62170342-067D-442C-88FB-64A4BEA8AFE4",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.3.3006:build_20250108:*:*:*:*:*:*",
                "matchCriteriaId": "82464467-E1E6-47E1-BDE5-DDFA52994A47",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.4.3070:build_20250312:*:*:*:*:*:*",
                "matchCriteriaId": "75AE902C-0516-4341-9BF0-21D8803E091C",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.4.3079:build_20250321:*:*:*:*:*:*",
                "matchCriteriaId": "5B005D70-8C91-48D4-B09A-9EBE2E9E5090",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.4.3092:build_20250403:*:*:*:*:*:*",
                "matchCriteriaId": "82FE5F89-A0E1-4D1B-A363-0A0D4141F502",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.5.3145:build_20250526:*:*:*:*:*:*",
                "matchCriteriaId": "B21A9EE0-88D5-42D9-BA21-D55518FCC6E4",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.6.3195:build_20250715:*:*:*:*:*:*",
                "matchCriteriaId": "3B575CF2-21F3-4435-B6B4-61D79B34429C",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.6.3229:build_20250818:*:*:*:*:*:*",
                "matchCriteriaId": "E2EBD305-91E3-4BCC-835B-4878DF4DA3B8",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.7.3256:build_20250913:*:*:*:*:*:*",
                "matchCriteriaId": "554CB021-1477-4E63-8EBA-74056B4D8DA7",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.7.3297:build_20251024:*:*:*:*:*:*",
                "matchCriteriaId": "153F90E1-A54F-4B8D-AEEA-4643421AFF7F",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      },
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2737:build_20240417:*:*:*:*:*:*",
                "matchCriteriaId": "CDCBB36A-CB91-4BA3-A6ED-952E6A4A0481",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2782:build_20240601:*:*:*:*:*:*",
                "matchCriteriaId": "240BCFF1-CCCB-4C07-8E2C-7F43F68407FC",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2789:build_20240607:*:*:*:*:*:*",
                "matchCriteriaId": "D3AF7276-77E0-474A-B10F-AC15BC5FCF00",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2802:build_20240620:*:*:*:*:*:*",
                "matchCriteriaId": "5FA8C3EC-B6C0-44A8-BC91-18E3E90C63AB",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2823:build_20240711:*:*:*:*:*:*",
                "matchCriteriaId": "889336D2-D9F7-4CC0-A22F-B837B5E77751",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2851:build_20240808:*:*:*:*:*:*",
                "matchCriteriaId": "98F72EB9-0EE3-416A-B9BB-2512F5203A5A",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2860:build_20240817:*:*:*:*:*:*",
                "matchCriteriaId": "9110382F-57C2-4C2E-82D1-3246C882B2C3",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.1.2929:build_20241025:*:*:*:*:*:*",
                "matchCriteriaId": "DB92EFD7-47DD-4AAC-97BD-A2D4918FF4ED",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.1.2940:build_20241105:*:*:*:*:*:*",
                "matchCriteriaId": "78E38E23-1AD0-49E1-89FA-73DC2F496137",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.2.2952:build_20241116:*:*:*:*:*:*",
                "matchCriteriaId": "F2F302B6-26CC-4044-B480-4EBDBB90797F",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.3.3006:build_20250108:*:*:*:*:*:*",
                "matchCriteriaId": "BF0093B6-8D38-4D1E-AD71-79299123C2B1",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.4.3070:build_20250312:*:*:*:*:*:*",
                "matchCriteriaId": "48A3CDAA-B0C6-4280-B1AC-DDD027F9D632",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.4.3079:build_20250321:*:*:*:*:*:*",
                "matchCriteriaId": "1807DE4F-CDF3-4E3B-ADC1-9535EF1D60FE",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.5.3138:build_20250519:*:*:*:*:*:*",
                "matchCriteriaId": "68FF7342-A0AF-4E75-9CD6-D584B450B8AB",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.6.3195:build_20250715:*:*:*:*:*:*",
                "matchCriteriaId": "A8E84E3D-943C-4DF5-86D3-DCAC3C034B81",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.7.3256:build_20250913:*:*:*:*:*:*",
                "matchCriteriaId": "17720E05-1BBF-4605-A777-FA4059B3C2DC",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.7.3297:build_20251024:*:*:*:*:*:*",
                "matchCriteriaId": "39CB5F1C-9811-499D-9D32-34B40E0D475E",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.3.0.3115:build_20250430:*:*:*:*:*:*",
                "matchCriteriaId": "4175C7F7-E946-41C6-8863-E23233B91A2B",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.3.0.3145:build_20250530:*:*:*:*:*:*",
                "matchCriteriaId": "DE16C73E-9291-44FD-A9CB-B7C127E67A6F",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.3.0.3192:build_20250716:*:*:*:*:*:*",
                "matchCriteriaId": "ED4023E4-6C28-413A-B7B1-6CEEBC48A1C0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to modify memory or crash processes.\n\nWe have already fixed the vulnerability in the following version:\nQTS 5.2.8.3332 build 20251128 and later"
      },
      {
        "lang": "es",
        "value": "Se ha informado de una vulnerabilidad de desbordamiento de búfer que afecta a varias versiones del sistema operativo QNAP. Si un atacante remoto obtiene una cuenta de administrador, puede entonces explotar la vulnerabilidad para modificar la memoria o bloquear procesos.\n\nYa hemos corregido la vulnerabilidad en la siguiente versión:\nQTS 5.2.8.3332 build 20251128 y posteriores"
      }
    ],
    "id": "CVE-2025-62852",
    "lastModified": "2026-09-30T23:10:00.237",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.2,
          "impactScore": 5.2,
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ],
      "cvssMetricV40": [
        {
          "cvssData": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "availabilityRequirement": "NOT_DEFINED",
            "baseScore": 1.2,
            "baseSeverity": "LOW",
            "confidentialityRequirement": "NOT_DEFINED",
            "exploitMaturity": "UNREPORTED",
            "integrityRequirement": "NOT_DEFINED",
            "modifiedAttackComplexity": "NOT_DEFINED",
            "modifiedAttackRequirements": "NOT_DEFINED",
            "modifiedAttackVector": "NOT_DEFINED",
            "modifiedPrivilegesRequired": "NOT_DEFINED",
            "modifiedSubAvailabilityImpact": "NOT_DEFINED",
            "modifiedSubConfidentialityImpact": "NOT_DEFINED",
            "modifiedSubIntegrityImpact": "NOT_DEFINED",
            "modifiedUserInteraction": "NOT_DEFINED",
            "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
            "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
            "modifiedVulnIntegrityImpact": "NOT_DEFINED",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "source": "security@qnapsecurity.com.tw",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-62852",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-01-05T20:30:25.428565Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-01-02T16:17:00.850",
    "references": [
      {
        "source": "security@qnapsecurity.com.tw",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://www.qnap.com/en/security-advisory/qsa-25-51"
      }
    ],
    "sourceIdentifier": "security@qnapsecurity.com.tw",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-121"
          }
        ],
        "source": "security@qnapsecurity.com.tw",
        "type": "Secondary"
      },
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-787"
          }
        ],
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  }
}

—

CVSS

cvss

NVD

6.5

receipt

Source: NVD
Its words: 6.5
Read by: field:cve.metrics.cvssMetricV31[type=Primary].cvssData.baseScore || field:cve.metrics.cvssMetricV31[].cvssData.baseScore
Said since: 2026-10-02 12:00 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "QTS",
            "vendor": "QNAP Systems Inc.",
            "versions": [
              {
                "lessThan": "5.2.8.3332 build 20251128",
                "status": "affected",
                "version": "5.2.x",
                "versionType": "custom"
              }
            ]
          }
        ],
        "source": "security@qnapsecurity.com.tw"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2737:build_20240417:*:*:*:*:*:*",
                "matchCriteriaId": "F4026A4B-7AB4-48EA-971D-88DFDD3F01A7",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2744:build_20240424:*:*:*:*:*:*",
                "matchCriteriaId": "1F3F99BB-0D68-4D74-92C8-59E24F96C50D",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2782:build_20240601:*:*:*:*:*:*",
                "matchCriteriaId": "1DE63B4D-8E84-41D3-B1F3-04AE6040242B",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2802:build_20240620:*:*:*:*:*:*",
                "matchCriteriaId": "75746563-C648-4E55-9126-703F915F8B8A",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2823:build_20240711:*:*:*:*:*:*",
                "matchCriteriaId": "AF6BA027-A635-4E90-80C8-130B10AB3D23",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2851:build_20240808:*:*:*:*:*:*",
                "matchCriteriaId": "5406F242-A215-4B07-809F-7A7CE55ACE71",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2860:build_20240817:*:*:*:*:*:*",
                "matchCriteriaId": "FA17778E-B3B1-44DD-B4E9-5AD25A3E804C",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.1.2930:build_20241025:*:*:*:*:*:*",
                "matchCriteriaId": "E3FC6646-2247-4ED9-9643-CD376674E2E7",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.2.2950:build_20241114:*:*:*:*:*:*",
                "matchCriteriaId": "62170342-067D-442C-88FB-64A4BEA8AFE4",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.3.3006:build_20250108:*:*:*:*:*:*",
                "matchCriteriaId": "82464467-E1E6-47E1-BDE5-DDFA52994A47",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.4.3070:build_20250312:*:*:*:*:*:*",
                "matchCriteriaId": "75AE902C-0516-4341-9BF0-21D8803E091C",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.4.3079:build_20250321:*:*:*:*:*:*",
                "matchCriteriaId": "5B005D70-8C91-48D4-B09A-9EBE2E9E5090",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.4.3092:build_20250403:*:*:*:*:*:*",
                "matchCriteriaId": "82FE5F89-A0E1-4D1B-A363-0A0D4141F502",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.5.3145:build_20250526:*:*:*:*:*:*",
                "matchCriteriaId": "B21A9EE0-88D5-42D9-BA21-D55518FCC6E4",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.6.3195:build_20250715:*:*:*:*:*:*",
                "matchCriteriaId": "3B575CF2-21F3-4435-B6B4-61D79B34429C",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.6.3229:build_20250818:*:*:*:*:*:*",
                "matchCriteriaId": "E2EBD305-91E3-4BCC-835B-4878DF4DA3B8",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.7.3256:build_20250913:*:*:*:*:*:*",
                "matchCriteriaId": "554CB021-1477-4E63-8EBA-74056B4D8DA7",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.7.3297:build_20251024:*:*:*:*:*:*",
                "matchCriteriaId": "153F90E1-A54F-4B8D-AEEA-4643421AFF7F",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      },
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2737:build_20240417:*:*:*:*:*:*",
                "matchCriteriaId": "CDCBB36A-CB91-4BA3-A6ED-952E6A4A0481",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2782:build_20240601:*:*:*:*:*:*",
                "matchCriteriaId": "240BCFF1-CCCB-4C07-8E2C-7F43F68407FC",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2789:build_20240607:*:*:*:*:*:*",
                "matchCriteriaId": "D3AF7276-77E0-474A-B10F-AC15BC5FCF00",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2802:build_20240620:*:*:*:*:*:*",
                "matchCriteriaId": "5FA8C3EC-B6C0-44A8-BC91-18E3E90C63AB",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2823:build_20240711:*:*:*:*:*:*",
                "matchCriteriaId": "889336D2-D9F7-4CC0-A22F-B837B5E77751",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2851:build_20240808:*:*:*:*:*:*",
                "matchCriteriaId": "98F72EB9-0EE3-416A-B9BB-2512F5203A5A",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2860:build_20240817:*:*:*:*:*:*",
                "matchCriteriaId": "9110382F-57C2-4C2E-82D1-3246C882B2C3",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.1.2929:build_20241025:*:*:*:*:*:*",
                "matchCriteriaId": "DB92EFD7-47DD-4AAC-97BD-A2D4918FF4ED",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.1.2940:build_20241105:*:*:*:*:*:*",
                "matchCriteriaId": "78E38E23-1AD0-49E1-89FA-73DC2F496137",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.2.2952:build_20241116:*:*:*:*:*:*",
                "matchCriteriaId": "F2F302B6-26CC-4044-B480-4EBDBB90797F",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.3.3006:build_20250108:*:*:*:*:*:*",
                "matchCriteriaId": "BF0093B6-8D38-4D1E-AD71-79299123C2B1",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.4.3070:build_20250312:*:*:*:*:*:*",
                "matchCriteriaId": "48A3CDAA-B0C6-4280-B1AC-DDD027F9D632",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.4.3079:build_20250321:*:*:*:*:*:*",
                "matchCriteriaId": "1807DE4F-CDF3-4E3B-ADC1-9535EF1D60FE",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.5.3138:build_20250519:*:*:*:*:*:*",
                "matchCriteriaId": "68FF7342-A0AF-4E75-9CD6-D584B450B8AB",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.6.3195:build_20250715:*:*:*:*:*:*",
                "matchCriteriaId": "A8E84E3D-943C-4DF5-86D3-DCAC3C034B81",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.7.3256:build_20250913:*:*:*:*:*:*",
                "matchCriteriaId": "17720E05-1BBF-4605-A777-FA4059B3C2DC",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.7.3297:build_20251024:*:*:*:*:*:*",
                "matchCriteriaId": "39CB5F1C-9811-499D-9D32-34B40E0D475E",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.3.0.3115:build_20250430:*:*:*:*:*:*",
                "matchCriteriaId": "4175C7F7-E946-41C6-8863-E23233B91A2B",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.3.0.3145:build_20250530:*:*:*:*:*:*",
                "matchCriteriaId": "DE16C73E-9291-44FD-A9CB-B7C127E67A6F",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.3.0.3192:build_20250716:*:*:*:*:*:*",
                "matchCriteriaId": "ED4023E4-6C28-413A-B7B1-6CEEBC48A1C0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to modify memory or crash processes.\n\nWe have already fixed the vulnerability in the following version:\nQTS 5.2.8.3332 build 20251128 and later"
      },
      {
        "lang": "es",
        "value": "Se ha informado de una vulnerabilidad de desbordamiento de búfer que afecta a varias versiones del sistema operativo QNAP. Si un atacante remoto obtiene una cuenta de administrador, puede entonces explotar la vulnerabilidad para modificar la memoria o bloquear procesos.\n\nYa hemos corregido la vulnerabilidad en la siguiente versión:\nQTS 5.2.8.3332 build 20251128 y posteriores"
      }
    ],
    "id": "CVE-2025-62852",
    "lastModified": "2026-09-30T23:10:00.237",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.2,
          "impactScore": 5.2,
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ],
      "cvssMetricV40": [
        {
          "cvssData": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "availabilityRequirement": "NOT_DEFINED",
            "baseScore": 1.2,
            "baseSeverity": "LOW",
            "confidentialityRequirement": "NOT_DEFINED",
            "exploitMaturity": "UNREPORTED",
            "integrityRequirement": "NOT_DEFINED",
            "modifiedAttackComplexity": "NOT_DEFINED",
            "modifiedAttackRequirements": "NOT_DEFINED",
            "modifiedAttackVector": "NOT_DEFINED",
            "modifiedPrivilegesRequired": "NOT_DEFINED",
            "modifiedSubAvailabilityImpact": "NOT_DEFINED",
            "modifiedSubConfidentialityImpact": "NOT_DEFINED",
            "modifiedSubIntegrityImpact": "NOT_DEFINED",
            "modifiedUserInteraction": "NOT_DEFINED",
            "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
            "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
            "modifiedVulnIntegrityImpact": "NOT_DEFINED",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "source": "security@qnapsecurity.com.tw",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-62852",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-01-05T20:30:25.428565Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-01-02T16:17:00.850",
    "references": [
      {
        "source": "security@qnapsecurity.com.tw",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://www.qnap.com/en/security-advisory/qsa-25-51"
      }
    ],
    "sourceIdentifier": "security@qnapsecurity.com.tw",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-121"
          }
        ],
        "source": "security@qnapsecurity.com.tw",
        "type": "Secondary"
      },
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-787"
          }
        ],
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  }
}

—

Cvss4

cvss4

NVD

1.2

receipt

Source: NVD
Its words: 1.2
Read by: field:cve.metrics.cvssMetricV40[type=Primary].cvssData.baseScore || field:cve.metrics.cvssMetricV40[].cvssData.baseScore
Said since: 2026-10-06 12:29 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-10-06 12:29 UTC	1.2
2026-10-02 12:00 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "QTS",
            "vendor": "QNAP Systems Inc.",
            "versions": [
              {
                "lessThan": "5.2.8.3332 build 20251128",
                "status": "affected",
                "version": "5.2.x",
                "versionType": "custom"
              }
            ]
          }
        ],
        "source": "security@qnapsecurity.com.tw"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2737:build_20240417:*:*:*:*:*:*",
                "matchCriteriaId": "F4026A4B-7AB4-48EA-971D-88DFDD3F01A7",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2744:build_20240424:*:*:*:*:*:*",
                "matchCriteriaId": "1F3F99BB-0D68-4D74-92C8-59E24F96C50D",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2782:build_20240601:*:*:*:*:*:*",
                "matchCriteriaId": "1DE63B4D-8E84-41D3-B1F3-04AE6040242B",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2802:build_20240620:*:*:*:*:*:*",
                "matchCriteriaId": "75746563-C648-4E55-9126-703F915F8B8A",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2823:build_20240711:*:*:*:*:*:*",
                "matchCriteriaId": "AF6BA027-A635-4E90-80C8-130B10AB3D23",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2851:build_20240808:*:*:*:*:*:*",
                "matchCriteriaId": "5406F242-A215-4B07-809F-7A7CE55ACE71",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2860:build_20240817:*:*:*:*:*:*",
                "matchCriteriaId": "FA17778E-B3B1-44DD-B4E9-5AD25A3E804C",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.1.2930:build_20241025:*:*:*:*:*:*",
                "matchCriteriaId": "E3FC6646-2247-4ED9-9643-CD376674E2E7",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.2.2950:build_20241114:*:*:*:*:*:*",
                "matchCriteriaId": "62170342-067D-442C-88FB-64A4BEA8AFE4",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.3.3006:build_20250108:*:*:*:*:*:*",
                "matchCriteriaId": "82464467-E1E6-47E1-BDE5-DDFA52994A47",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.4.3070:build_20250312:*:*:*:*:*:*",
                "matchCriteriaId": "75AE902C-0516-4341-9BF0-21D8803E091C",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.4.3079:build_20250321:*:*:*:*:*:*",
                "matchCriteriaId": "5B005D70-8C91-48D4-B09A-9EBE2E9E5090",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.4.3092:build_20250403:*:*:*:*:*:*",
                "matchCriteriaId": "82FE5F89-A0E1-4D1B-A363-0A0D4141F502",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.5.3145:build_20250526:*:*:*:*:*:*",
                "matchCriteriaId": "B21A9EE0-88D5-42D9-BA21-D55518FCC6E4",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.6.3195:build_20250715:*:*:*:*:*:*",
                "matchCriteriaId": "3B575CF2-21F3-4435-B6B4-61D79B34429C",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.6.3229:build_20250818:*:*:*:*:*:*",
                "matchCriteriaId": "E2EBD305-91E3-4BCC-835B-4878DF4DA3B8",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.7.3256:build_20250913:*:*:*:*:*:*",
                "matchCriteriaId": "554CB021-1477-4E63-8EBA-74056B4D8DA7",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.7.3297:build_20251024:*:*:*:*:*:*",
                "matchCriteriaId": "153F90E1-A54F-4B8D-AEEA-4643421AFF7F",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      },
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2737:build_20240417:*:*:*:*:*:*",
                "matchCriteriaId": "CDCBB36A-CB91-4BA3-A6ED-952E6A4A0481",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2782:build_20240601:*:*:*:*:*:*",
                "matchCriteriaId": "240BCFF1-CCCB-4C07-8E2C-7F43F68407FC",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2789:build_20240607:*:*:*:*:*:*",
                "matchCriteriaId": "D3AF7276-77E0-474A-B10F-AC15BC5FCF00",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2802:build_20240620:*:*:*:*:*:*",
                "matchCriteriaId": "5FA8C3EC-B6C0-44A8-BC91-18E3E90C63AB",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2823:build_20240711:*:*:*:*:*:*",
                "matchCriteriaId": "889336D2-D9F7-4CC0-A22F-B837B5E77751",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2851:build_20240808:*:*:*:*:*:*",
                "matchCriteriaId": "98F72EB9-0EE3-416A-B9BB-2512F5203A5A",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2860:build_20240817:*:*:*:*:*:*",
                "matchCriteriaId": "9110382F-57C2-4C2E-82D1-3246C882B2C3",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.1.2929:build_20241025:*:*:*:*:*:*",
                "matchCriteriaId": "DB92EFD7-47DD-4AAC-97BD-A2D4918FF4ED",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.1.2940:build_20241105:*:*:*:*:*:*",
                "matchCriteriaId": "78E38E23-1AD0-49E1-89FA-73DC2F496137",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.2.2952:build_20241116:*:*:*:*:*:*",
                "matchCriteriaId": "F2F302B6-26CC-4044-B480-4EBDBB90797F",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.3.3006:build_20250108:*:*:*:*:*:*",
                "matchCriteriaId": "BF0093B6-8D38-4D1E-AD71-79299123C2B1",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.4.3070:build_20250312:*:*:*:*:*:*",
                "matchCriteriaId": "48A3CDAA-B0C6-4280-B1AC-DDD027F9D632",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.4.3079:build_20250321:*:*:*:*:*:*",
                "matchCriteriaId": "1807DE4F-CDF3-4E3B-ADC1-9535EF1D60FE",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.5.3138:build_20250519:*:*:*:*:*:*",
                "matchCriteriaId": "68FF7342-A0AF-4E75-9CD6-D584B450B8AB",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.6.3195:build_20250715:*:*:*:*:*:*",
                "matchCriteriaId": "A8E84E3D-943C-4DF5-86D3-DCAC3C034B81",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.7.3256:build_20250913:*:*:*:*:*:*",
                "matchCriteriaId": "17720E05-1BBF-4605-A777-FA4059B3C2DC",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.7.3297:build_20251024:*:*:*:*:*:*",
                "matchCriteriaId": "39CB5F1C-9811-499D-9D32-34B40E0D475E",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.3.0.3115:build_20250430:*:*:*:*:*:*",
                "matchCriteriaId": "4175C7F7-E946-41C6-8863-E23233B91A2B",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.3.0.3145:build_20250530:*:*:*:*:*:*",
                "matchCriteriaId": "DE16C73E-9291-44FD-A9CB-B7C127E67A6F",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.3.0.3192:build_20250716:*:*:*:*:*:*",
                "matchCriteriaId": "ED4023E4-6C28-413A-B7B1-6CEEBC48A1C0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to modify memory or crash processes.\n\nWe have already fixed the vulnerability in the following version:\nQTS 5.2.8.3332 build 20251128 and later"
      },
      {
        "lang": "es",
        "value": "Se ha informado de una vulnerabilidad de desbordamiento de búfer que afecta a varias versiones del sistema operativo QNAP. Si un atacante remoto obtiene una cuenta de administrador, puede entonces explotar la vulnerabilidad para modificar la memoria o bloquear procesos.\n\nYa hemos corregido la vulnerabilidad en la siguiente versión:\nQTS 5.2.8.3332 build 20251128 y posteriores"
      }
    ],
    "id": "CVE-2025-62852",
    "lastModified": "2026-09-30T23:10:00.237",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.2,
          "impactScore": 5.2,
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ],
      "cvssMetricV40": [
        {
          "cvssData": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "availabilityRequirement": "NOT_DEFINED",
            "baseScore": 1.2,
            "baseSeverity": "LOW",
            "confidentialityRequirement": "NOT_DEFINED",
            "exploitMaturity": "UNREPORTED",
            "integrityRequirement": "NOT_DEFINED",
            "modifiedAttackComplexity": "NOT_DEFINED",
            "modifiedAttackRequirements": "NOT_DEFINED",
            "modifiedAttackVector": "NOT_DEFINED",
            "modifiedPrivilegesRequired": "NOT_DEFINED",
            "modifiedSubAvailabilityImpact": "NOT_DEFINED",
            "modifiedSubConfidentialityImpact": "NOT_DEFINED",
            "modifiedSubIntegrityImpact": "NOT_DEFINED",
            "modifiedUserInteraction": "NOT_DEFINED",
            "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
            "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
            "modifiedVulnIntegrityImpact": "NOT_DEFINED",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "source": "security@qnapsecurity.com.tw",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-62852",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-01-05T20:30:25.428565Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-01-02T16:17:00.850",
    "references": [
      {
        "source": "security@qnapsecurity.com.tw",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://www.qnap.com/en/security-advisory/qsa-25-51"
      }
    ],
    "sourceIdentifier": "security@qnapsecurity.com.tw",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-121"
          }
        ],
        "source": "security@qnapsecurity.com.tw",
        "type": "Secondary"
      },
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-787"
          }
        ],
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  }
}

—

Cvss4 vector

cvss4_vector

NVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

receipt

Source: NVD
Its words: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Read by: field:cve.metrics.cvssMetricV40[type=Primary].cvssData.vectorString || field:cve.metrics.cvssMetricV40[].cvssData.vectorString
Said since: 2026-10-06 12:29 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-10-06 12:29 UTC	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
2026-10-02 12:00 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "QTS",
            "vendor": "QNAP Systems Inc.",
            "versions": [
              {
                "lessThan": "5.2.8.3332 build 20251128",
                "status": "affected",
                "version": "5.2.x",
                "versionType": "custom"
              }
            ]
          }
        ],
        "source": "security@qnapsecurity.com.tw"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2737:build_20240417:*:*:*:*:*:*",
                "matchCriteriaId": "F4026A4B-7AB4-48EA-971D-88DFDD3F01A7",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2744:build_20240424:*:*:*:*:*:*",
                "matchCriteriaId": "1F3F99BB-0D68-4D74-92C8-59E24F96C50D",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2782:build_20240601:*:*:*:*:*:*",
                "matchCriteriaId": "1DE63B4D-8E84-41D3-B1F3-04AE6040242B",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2802:build_20240620:*:*:*:*:*:*",
                "matchCriteriaId": "75746563-C648-4E55-9126-703F915F8B8A",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2823:build_20240711:*:*:*:*:*:*",
                "matchCriteriaId": "AF6BA027-A635-4E90-80C8-130B10AB3D23",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2851:build_20240808:*:*:*:*:*:*",
                "matchCriteriaId": "5406F242-A215-4B07-809F-7A7CE55ACE71",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2860:build_20240817:*:*:*:*:*:*",
                "matchCriteriaId": "FA17778E-B3B1-44DD-B4E9-5AD25A3E804C",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.1.2930:build_20241025:*:*:*:*:*:*",
                "matchCriteriaId": "E3FC6646-2247-4ED9-9643-CD376674E2E7",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.2.2950:build_20241114:*:*:*:*:*:*",
                "matchCriteriaId": "62170342-067D-442C-88FB-64A4BEA8AFE4",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.3.3006:build_20250108:*:*:*:*:*:*",
                "matchCriteriaId": "82464467-E1E6-47E1-BDE5-DDFA52994A47",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.4.3070:build_20250312:*:*:*:*:*:*",
                "matchCriteriaId": "75AE902C-0516-4341-9BF0-21D8803E091C",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.4.3079:build_20250321:*:*:*:*:*:*",
                "matchCriteriaId": "5B005D70-8C91-48D4-B09A-9EBE2E9E5090",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.4.3092:build_20250403:*:*:*:*:*:*",
                "matchCriteriaId": "82FE5F89-A0E1-4D1B-A363-0A0D4141F502",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.5.3145:build_20250526:*:*:*:*:*:*",
                "matchCriteriaId": "B21A9EE0-88D5-42D9-BA21-D55518FCC6E4",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.6.3195:build_20250715:*:*:*:*:*:*",
                "matchCriteriaId": "3B575CF2-21F3-4435-B6B4-61D79B34429C",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.6.3229:build_20250818:*:*:*:*:*:*",
                "matchCriteriaId": "E2EBD305-91E3-4BCC-835B-4878DF4DA3B8",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.7.3256:build_20250913:*:*:*:*:*:*",
                "matchCriteriaId": "554CB021-1477-4E63-8EBA-74056B4D8DA7",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.7.3297:build_20251024:*:*:*:*:*:*",
                "matchCriteriaId": "153F90E1-A54F-4B8D-AEEA-4643421AFF7F",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      },
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2737:build_20240417:*:*:*:*:*:*",
                "matchCriteriaId": "CDCBB36A-CB91-4BA3-A6ED-952E6A4A0481",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2782:build_20240601:*:*:*:*:*:*",
                "matchCriteriaId": "240BCFF1-CCCB-4C07-8E2C-7F43F68407FC",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2789:build_20240607:*:*:*:*:*:*",
                "matchCriteriaId": "D3AF7276-77E0-474A-B10F-AC15BC5FCF00",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2802:build_20240620:*:*:*:*:*:*",
                "matchCriteriaId": "5FA8C3EC-B6C0-44A8-BC91-18E3E90C63AB",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2823:build_20240711:*:*:*:*:*:*",
                "matchCriteriaId": "889336D2-D9F7-4CC0-A22F-B837B5E77751",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2851:build_20240808:*:*:*:*:*:*",
                "matchCriteriaId": "98F72EB9-0EE3-416A-B9BB-2512F5203A5A",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2860:build_20240817:*:*:*:*:*:*",
                "matchCriteriaId": "9110382F-57C2-4C2E-82D1-3246C882B2C3",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.1.2929:build_20241025:*:*:*:*:*:*",
                "matchCriteriaId": "DB92EFD7-47DD-4AAC-97BD-A2D4918FF4ED",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.1.2940:build_20241105:*:*:*:*:*:*",
                "matchCriteriaId": "78E38E23-1AD0-49E1-89FA-73DC2F496137",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.2.2952:build_20241116:*:*:*:*:*:*",
                "matchCriteriaId": "F2F302B6-26CC-4044-B480-4EBDBB90797F",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.3.3006:build_20250108:*:*:*:*:*:*",
                "matchCriteriaId": "BF0093B6-8D38-4D1E-AD71-79299123C2B1",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.4.3070:build_20250312:*:*:*:*:*:*",
                "matchCriteriaId": "48A3CDAA-B0C6-4280-B1AC-DDD027F9D632",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.4.3079:build_20250321:*:*:*:*:*:*",
                "matchCriteriaId": "1807DE4F-CDF3-4E3B-ADC1-9535EF1D60FE",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.5.3138:build_20250519:*:*:*:*:*:*",
                "matchCriteriaId": "68FF7342-A0AF-4E75-9CD6-D584B450B8AB",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.6.3195:build_20250715:*:*:*:*:*:*",
                "matchCriteriaId": "A8E84E3D-943C-4DF5-86D3-DCAC3C034B81",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.7.3256:build_20250913:*:*:*:*:*:*",
                "matchCriteriaId": "17720E05-1BBF-4605-A777-FA4059B3C2DC",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.7.3297:build_20251024:*:*:*:*:*:*",
                "matchCriteriaId": "39CB5F1C-9811-499D-9D32-34B40E0D475E",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.3.0.3115:build_20250430:*:*:*:*:*:*",
                "matchCriteriaId": "4175C7F7-E946-41C6-8863-E23233B91A2B",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.3.0.3145:build_20250530:*:*:*:*:*:*",
                "matchCriteriaId": "DE16C73E-9291-44FD-A9CB-B7C127E67A6F",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.3.0.3192:build_20250716:*:*:*:*:*:*",
                "matchCriteriaId": "ED4023E4-6C28-413A-B7B1-6CEEBC48A1C0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to modify memory or crash processes.\n\nWe have already fixed the vulnerability in the following version:\nQTS 5.2.8.3332 build 20251128 and later"
      },
      {
        "lang": "es",
        "value": "Se ha informado de una vulnerabilidad de desbordamiento de búfer que afecta a varias versiones del sistema operativo QNAP. Si un atacante remoto obtiene una cuenta de administrador, puede entonces explotar la vulnerabilidad para modificar la memoria o bloquear procesos.\n\nYa hemos corregido la vulnerabilidad en la siguiente versión:\nQTS 5.2.8.3332 build 20251128 y posteriores"
      }
    ],
    "id": "CVE-2025-62852",
    "lastModified": "2026-09-30T23:10:00.237",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.2,
          "impactScore": 5.2,
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ],
      "cvssMetricV40": [
        {
          "cvssData": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "availabilityRequirement": "NOT_DEFINED",
            "baseScore": 1.2,
            "baseSeverity": "LOW",
            "confidentialityRequirement": "NOT_DEFINED",
            "exploitMaturity": "UNREPORTED",
            "integrityRequirement": "NOT_DEFINED",
            "modifiedAttackComplexity": "NOT_DEFINED",
            "modifiedAttackRequirements": "NOT_DEFINED",
            "modifiedAttackVector": "NOT_DEFINED",
            "modifiedPrivilegesRequired": "NOT_DEFINED",
            "modifiedSubAvailabilityImpact": "NOT_DEFINED",
            "modifiedSubConfidentialityImpact": "NOT_DEFINED",
            "modifiedSubIntegrityImpact": "NOT_DEFINED",
            "modifiedUserInteraction": "NOT_DEFINED",
            "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
            "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
            "modifiedVulnIntegrityImpact": "NOT_DEFINED",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "source": "security@qnapsecurity.com.tw",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-62852",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-01-05T20:30:25.428565Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-01-02T16:17:00.850",
    "references": [
      {
        "source": "security@qnapsecurity.com.tw",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://www.qnap.com/en/security-advisory/qsa-25-51"
      }
    ],
    "sourceIdentifier": "security@qnapsecurity.com.tw",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-121"
          }
        ],
        "source": "security@qnapsecurity.com.tw",
        "type": "Secondary"
      },
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-787"
          }
        ],
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  }
}

—

CVSS vector

cvss_vector

NVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

receipt

Source: NVD
Its words: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Read by: field:cve.metrics.cvssMetricV31[type=Primary].cvssData.vectorString || field:cve.metrics.cvssMetricV31[].cvssData.vectorString
Said since: 2026-10-06 12:29 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-10-06 12:29 UTC	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
2026-10-02 12:00 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "QTS",
            "vendor": "QNAP Systems Inc.",
            "versions": [
              {
                "lessThan": "5.2.8.3332 build 20251128",
                "status": "affected",
                "version": "5.2.x",
                "versionType": "custom"
              }
            ]
          }
        ],
        "source": "security@qnapsecurity.com.tw"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2737:build_20240417:*:*:*:*:*:*",
                "matchCriteriaId": "F4026A4B-7AB4-48EA-971D-88DFDD3F01A7",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2744:build_20240424:*:*:*:*:*:*",
                "matchCriteriaId": "1F3F99BB-0D68-4D74-92C8-59E24F96C50D",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2782:build_20240601:*:*:*:*:*:*",
                "matchCriteriaId": "1DE63B4D-8E84-41D3-B1F3-04AE6040242B",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2802:build_20240620:*:*:*:*:*:*",
                "matchCriteriaId": "75746563-C648-4E55-9126-703F915F8B8A",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2823:build_20240711:*:*:*:*:*:*",
                "matchCriteriaId": "AF6BA027-A635-4E90-80C8-130B10AB3D23",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2851:build_20240808:*:*:*:*:*:*",
                "matchCriteriaId": "5406F242-A215-4B07-809F-7A7CE55ACE71",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2860:build_20240817:*:*:*:*:*:*",
                "matchCriteriaId": "FA17778E-B3B1-44DD-B4E9-5AD25A3E804C",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.1.2930:build_20241025:*:*:*:*:*:*",
                "matchCriteriaId": "E3FC6646-2247-4ED9-9643-CD376674E2E7",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.2.2950:build_20241114:*:*:*:*:*:*",
                "matchCriteriaId": "62170342-067D-442C-88FB-64A4BEA8AFE4",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.3.3006:build_20250108:*:*:*:*:*:*",
                "matchCriteriaId": "82464467-E1E6-47E1-BDE5-DDFA52994A47",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.4.3070:build_20250312:*:*:*:*:*:*",
                "matchCriteriaId": "75AE902C-0516-4341-9BF0-21D8803E091C",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.4.3079:build_20250321:*:*:*:*:*:*",
                "matchCriteriaId": "5B005D70-8C91-48D4-B09A-9EBE2E9E5090",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.4.3092:build_20250403:*:*:*:*:*:*",
                "matchCriteriaId": "82FE5F89-A0E1-4D1B-A363-0A0D4141F502",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.5.3145:build_20250526:*:*:*:*:*:*",
                "matchCriteriaId": "B21A9EE0-88D5-42D9-BA21-D55518FCC6E4",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.6.3195:build_20250715:*:*:*:*:*:*",
                "matchCriteriaId": "3B575CF2-21F3-4435-B6B4-61D79B34429C",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.6.3229:build_20250818:*:*:*:*:*:*",
                "matchCriteriaId": "E2EBD305-91E3-4BCC-835B-4878DF4DA3B8",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.7.3256:build_20250913:*:*:*:*:*:*",
                "matchCriteriaId": "554CB021-1477-4E63-8EBA-74056B4D8DA7",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.7.3297:build_20251024:*:*:*:*:*:*",
                "matchCriteriaId": "153F90E1-A54F-4B8D-AEEA-4643421AFF7F",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      },
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2737:build_20240417:*:*:*:*:*:*",
                "matchCriteriaId": "CDCBB36A-CB91-4BA3-A6ED-952E6A4A0481",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2782:build_20240601:*:*:*:*:*:*",
                "matchCriteriaId": "240BCFF1-CCCB-4C07-8E2C-7F43F68407FC",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2789:build_20240607:*:*:*:*:*:*",
                "matchCriteriaId": "D3AF7276-77E0-474A-B10F-AC15BC5FCF00",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2802:build_20240620:*:*:*:*:*:*",
                "matchCriteriaId": "5FA8C3EC-B6C0-44A8-BC91-18E3E90C63AB",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2823:build_20240711:*:*:*:*:*:*",
                "matchCriteriaId": "889336D2-D9F7-4CC0-A22F-B837B5E77751",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2851:build_20240808:*:*:*:*:*:*",
                "matchCriteriaId": "98F72EB9-0EE3-416A-B9BB-2512F5203A5A",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2860:build_20240817:*:*:*:*:*:*",
                "matchCriteriaId": "9110382F-57C2-4C2E-82D1-3246C882B2C3",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.1.2929:build_20241025:*:*:*:*:*:*",
                "matchCriteriaId": "DB92EFD7-47DD-4AAC-97BD-A2D4918FF4ED",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.1.2940:build_20241105:*:*:*:*:*:*",
                "matchCriteriaId": "78E38E23-1AD0-49E1-89FA-73DC2F496137",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.2.2952:build_20241116:*:*:*:*:*:*",
                "matchCriteriaId": "F2F302B6-26CC-4044-B480-4EBDBB90797F",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.3.3006:build_20250108:*:*:*:*:*:*",
                "matchCriteriaId": "BF0093B6-8D38-4D1E-AD71-79299123C2B1",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.4.3070:build_20250312:*:*:*:*:*:*",
                "matchCriteriaId": "48A3CDAA-B0C6-4280-B1AC-DDD027F9D632",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.4.3079:build_20250321:*:*:*:*:*:*",
                "matchCriteriaId": "1807DE4F-CDF3-4E3B-ADC1-9535EF1D60FE",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.5.3138:build_20250519:*:*:*:*:*:*",
                "matchCriteriaId": "68FF7342-A0AF-4E75-9CD6-D584B450B8AB",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.6.3195:build_20250715:*:*:*:*:*:*",
                "matchCriteriaId": "A8E84E3D-943C-4DF5-86D3-DCAC3C034B81",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.7.3256:build_20250913:*:*:*:*:*:*",
                "matchCriteriaId": "17720E05-1BBF-4605-A777-FA4059B3C2DC",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.7.3297:build_20251024:*:*:*:*:*:*",
                "matchCriteriaId": "39CB5F1C-9811-499D-9D32-34B40E0D475E",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.3.0.3115:build_20250430:*:*:*:*:*:*",
                "matchCriteriaId": "4175C7F7-E946-41C6-8863-E23233B91A2B",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.3.0.3145:build_20250530:*:*:*:*:*:*",
                "matchCriteriaId": "DE16C73E-9291-44FD-A9CB-B7C127E67A6F",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.3.0.3192:build_20250716:*:*:*:*:*:*",
                "matchCriteriaId": "ED4023E4-6C28-413A-B7B1-6CEEBC48A1C0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to modify memory or crash processes.\n\nWe have already fixed the vulnerability in the following version:\nQTS 5.2.8.3332 build 20251128 and later"
      },
      {
        "lang": "es",
        "value": "Se ha informado de una vulnerabilidad de desbordamiento de búfer que afecta a varias versiones del sistema operativo QNAP. Si un atacante remoto obtiene una cuenta de administrador, puede entonces explotar la vulnerabilidad para modificar la memoria o bloquear procesos.\n\nYa hemos corregido la vulnerabilidad en la siguiente versión:\nQTS 5.2.8.3332 build 20251128 y posteriores"
      }
    ],
    "id": "CVE-2025-62852",
    "lastModified": "2026-09-30T23:10:00.237",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.2,
          "impactScore": 5.2,
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ],
      "cvssMetricV40": [
        {
          "cvssData": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "availabilityRequirement": "NOT_DEFINED",
            "baseScore": 1.2,
            "baseSeverity": "LOW",
            "confidentialityRequirement": "NOT_DEFINED",
            "exploitMaturity": "UNREPORTED",
            "integrityRequirement": "NOT_DEFINED",
            "modifiedAttackComplexity": "NOT_DEFINED",
            "modifiedAttackRequirements": "NOT_DEFINED",
            "modifiedAttackVector": "NOT_DEFINED",
            "modifiedPrivilegesRequired": "NOT_DEFINED",
            "modifiedSubAvailabilityImpact": "NOT_DEFINED",
            "modifiedSubConfidentialityImpact": "NOT_DEFINED",
            "modifiedSubIntegrityImpact": "NOT_DEFINED",
            "modifiedUserInteraction": "NOT_DEFINED",
            "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
            "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
            "modifiedVulnIntegrityImpact": "NOT_DEFINED",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "source": "security@qnapsecurity.com.tw",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-62852",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-01-05T20:30:25.428565Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-01-02T16:17:00.850",
    "references": [
      {
        "source": "security@qnapsecurity.com.tw",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://www.qnap.com/en/security-advisory/qsa-25-51"
      }
    ],
    "sourceIdentifier": "security@qnapsecurity.com.tw",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-121"
          }
        ],
        "source": "security@qnapsecurity.com.tw",
        "type": "Secondary"
      },
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-787"
          }
        ],
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  }
}

—

CWE

cwe

NVD

CWE-121, CWE-787

receipt

Source: NVD
Its words: CWE-121, CWE-787
Read by: field:cve.weaknesses[].description[].value
Said since: 2026-10-06 12:29 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-10-06 12:29 UTC	CWE-121, CWE-787
2026-10-02 12:00 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "QTS",
            "vendor": "QNAP Systems Inc.",
            "versions": [
              {
                "lessThan": "5.2.8.3332 build 20251128",
                "status": "affected",
                "version": "5.2.x",
                "versionType": "custom"
              }
            ]
          }
        ],
        "source": "security@qnapsecurity.com.tw"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2737:build_20240417:*:*:*:*:*:*",
                "matchCriteriaId": "F4026A4B-7AB4-48EA-971D-88DFDD3F01A7",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2744:build_20240424:*:*:*:*:*:*",
                "matchCriteriaId": "1F3F99BB-0D68-4D74-92C8-59E24F96C50D",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2782:build_20240601:*:*:*:*:*:*",
                "matchCriteriaId": "1DE63B4D-8E84-41D3-B1F3-04AE6040242B",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2802:build_20240620:*:*:*:*:*:*",
                "matchCriteriaId": "75746563-C648-4E55-9126-703F915F8B8A",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2823:build_20240711:*:*:*:*:*:*",
                "matchCriteriaId": "AF6BA027-A635-4E90-80C8-130B10AB3D23",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2851:build_20240808:*:*:*:*:*:*",
                "matchCriteriaId": "5406F242-A215-4B07-809F-7A7CE55ACE71",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2860:build_20240817:*:*:*:*:*:*",
                "matchCriteriaId": "FA17778E-B3B1-44DD-B4E9-5AD25A3E804C",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.1.2930:build_20241025:*:*:*:*:*:*",
                "matchCriteriaId": "E3FC6646-2247-4ED9-9643-CD376674E2E7",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.2.2950:build_20241114:*:*:*:*:*:*",
                "matchCriteriaId": "62170342-067D-442C-88FB-64A4BEA8AFE4",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.3.3006:build_20250108:*:*:*:*:*:*",
                "matchCriteriaId": "82464467-E1E6-47E1-BDE5-DDFA52994A47",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.4.3070:build_20250312:*:*:*:*:*:*",
                "matchCriteriaId": "75AE902C-0516-4341-9BF0-21D8803E091C",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.4.3079:build_20250321:*:*:*:*:*:*",
                "matchCriteriaId": "5B005D70-8C91-48D4-B09A-9EBE2E9E5090",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.4.3092:build_20250403:*:*:*:*:*:*",
                "matchCriteriaId": "82FE5F89-A0E1-4D1B-A363-0A0D4141F502",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.5.3145:build_20250526:*:*:*:*:*:*",
                "matchCriteriaId": "B21A9EE0-88D5-42D9-BA21-D55518FCC6E4",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.6.3195:build_20250715:*:*:*:*:*:*",
                "matchCriteriaId": "3B575CF2-21F3-4435-B6B4-61D79B34429C",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.6.3229:build_20250818:*:*:*:*:*:*",
                "matchCriteriaId": "E2EBD305-91E3-4BCC-835B-4878DF4DA3B8",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.7.3256:build_20250913:*:*:*:*:*:*",
                "matchCriteriaId": "554CB021-1477-4E63-8EBA-74056B4D8DA7",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.7.3297:build_20251024:*:*:*:*:*:*",
                "matchCriteriaId": "153F90E1-A54F-4B8D-AEEA-4643421AFF7F",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      },
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2737:build_20240417:*:*:*:*:*:*",
                "matchCriteriaId": "CDCBB36A-CB91-4BA3-A6ED-952E6A4A0481",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2782:build_20240601:*:*:*:*:*:*",
                "matchCriteriaId": "240BCFF1-CCCB-4C07-8E2C-7F43F68407FC",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2789:build_20240607:*:*:*:*:*:*",
                "matchCriteriaId": "D3AF7276-77E0-474A-B10F-AC15BC5FCF00",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2802:build_20240620:*:*:*:*:*:*",
                "matchCriteriaId": "5FA8C3EC-B6C0-44A8-BC91-18E3E90C63AB",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2823:build_20240711:*:*:*:*:*:*",
                "matchCriteriaId": "889336D2-D9F7-4CC0-A22F-B837B5E77751",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2851:build_20240808:*:*:*:*:*:*",
                "matchCriteriaId": "98F72EB9-0EE3-416A-B9BB-2512F5203A5A",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2860:build_20240817:*:*:*:*:*:*",
                "matchCriteriaId": "9110382F-57C2-4C2E-82D1-3246C882B2C3",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.1.2929:build_20241025:*:*:*:*:*:*",
                "matchCriteriaId": "DB92EFD7-47DD-4AAC-97BD-A2D4918FF4ED",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.1.2940:build_20241105:*:*:*:*:*:*",
                "matchCriteriaId": "78E38E23-1AD0-49E1-89FA-73DC2F496137",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.2.2952:build_20241116:*:*:*:*:*:*",
                "matchCriteriaId": "F2F302B6-26CC-4044-B480-4EBDBB90797F",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.3.3006:build_20250108:*:*:*:*:*:*",
                "matchCriteriaId": "BF0093B6-8D38-4D1E-AD71-79299123C2B1",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.4.3070:build_20250312:*:*:*:*:*:*",
                "matchCriteriaId": "48A3CDAA-B0C6-4280-B1AC-DDD027F9D632",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.4.3079:build_20250321:*:*:*:*:*:*",
                "matchCriteriaId": "1807DE4F-CDF3-4E3B-ADC1-9535EF1D60FE",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.5.3138:build_20250519:*:*:*:*:*:*",
                "matchCriteriaId": "68FF7342-A0AF-4E75-9CD6-D584B450B8AB",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.6.3195:build_20250715:*:*:*:*:*:*",
                "matchCriteriaId": "A8E84E3D-943C-4DF5-86D3-DCAC3C034B81",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.7.3256:build_20250913:*:*:*:*:*:*",
                "matchCriteriaId": "17720E05-1BBF-4605-A777-FA4059B3C2DC",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.7.3297:build_20251024:*:*:*:*:*:*",
                "matchCriteriaId": "39CB5F1C-9811-499D-9D32-34B40E0D475E",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.3.0.3115:build_20250430:*:*:*:*:*:*",
                "matchCriteriaId": "4175C7F7-E946-41C6-8863-E23233B91A2B",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.3.0.3145:build_20250530:*:*:*:*:*:*",
                "matchCriteriaId": "DE16C73E-9291-44FD-A9CB-B7C127E67A6F",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.3.0.3192:build_20250716:*:*:*:*:*:*",
                "matchCriteriaId": "ED4023E4-6C28-413A-B7B1-6CEEBC48A1C0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to modify memory or crash processes.\n\nWe have already fixed the vulnerability in the following version:\nQTS 5.2.8.3332 build 20251128 and later"
      },
      {
        "lang": "es",
        "value": "Se ha informado de una vulnerabilidad de desbordamiento de búfer que afecta a varias versiones del sistema operativo QNAP. Si un atacante remoto obtiene una cuenta de administrador, puede entonces explotar la vulnerabilidad para modificar la memoria o bloquear procesos.\n\nYa hemos corregido la vulnerabilidad en la siguiente versión:\nQTS 5.2.8.3332 build 20251128 y posteriores"
      }
    ],
    "id": "CVE-2025-62852",
    "lastModified": "2026-09-30T23:10:00.237",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.2,
          "impactScore": 5.2,
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ],
      "cvssMetricV40": [
        {
          "cvssData": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "availabilityRequirement": "NOT_DEFINED",
            "baseScore": 1.2,
            "baseSeverity": "LOW",
            "confidentialityRequirement": "NOT_DEFINED",
            "exploitMaturity": "UNREPORTED",
            "integrityRequirement": "NOT_DEFINED",
            "modifiedAttackComplexity": "NOT_DEFINED",
            "modifiedAttackRequirements": "NOT_DEFINED",
            "modifiedAttackVector": "NOT_DEFINED",
            "modifiedPrivilegesRequired": "NOT_DEFINED",
            "modifiedSubAvailabilityImpact": "NOT_DEFINED",
            "modifiedSubConfidentialityImpact": "NOT_DEFINED",
            "modifiedSubIntegrityImpact": "NOT_DEFINED",
            "modifiedUserInteraction": "NOT_DEFINED",
            "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
            "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
            "modifiedVulnIntegrityImpact": "NOT_DEFINED",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "source": "security@qnapsecurity.com.tw",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-62852",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-01-05T20:30:25.428565Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-01-02T16:17:00.850",
    "references": [
      {
        "source": "security@qnapsecurity.com.tw",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://www.qnap.com/en/security-advisory/qsa-25-51"
      }
    ],
    "sourceIdentifier": "security@qnapsecurity.com.tw",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-121"
          }
        ],
        "source": "security@qnapsecurity.com.tw",
        "type": "Secondary"
      },
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-787"
          }
        ],
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  }
}

—

Exploitation

exploitation

NVD

none

No evidence of exploitation, and no public proof of concept.

receipt

Source: NVD
Its words: none
Read by: field:cve.metrics.ssvcV203[].ssvcData.options[].exploitation
Said since: 2026-10-06 12:29 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-10-06 12:29 UTC	none
2026-10-02 12:00 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "QTS",
            "vendor": "QNAP Systems Inc.",
            "versions": [
              {
                "lessThan": "5.2.8.3332 build 20251128",
                "status": "affected",
                "version": "5.2.x",
                "versionType": "custom"
              }
            ]
          }
        ],
        "source": "security@qnapsecurity.com.tw"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2737:build_20240417:*:*:*:*:*:*",
                "matchCriteriaId": "F4026A4B-7AB4-48EA-971D-88DFDD3F01A7",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2744:build_20240424:*:*:*:*:*:*",
                "matchCriteriaId": "1F3F99BB-0D68-4D74-92C8-59E24F96C50D",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2782:build_20240601:*:*:*:*:*:*",
                "matchCriteriaId": "1DE63B4D-8E84-41D3-B1F3-04AE6040242B",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2802:build_20240620:*:*:*:*:*:*",
                "matchCriteriaId": "75746563-C648-4E55-9126-703F915F8B8A",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2823:build_20240711:*:*:*:*:*:*",
                "matchCriteriaId": "AF6BA027-A635-4E90-80C8-130B10AB3D23",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2851:build_20240808:*:*:*:*:*:*",
                "matchCriteriaId": "5406F242-A215-4B07-809F-7A7CE55ACE71",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2860:build_20240817:*:*:*:*:*:*",
                "matchCriteriaId": "FA17778E-B3B1-44DD-B4E9-5AD25A3E804C",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.1.2930:build_20241025:*:*:*:*:*:*",
                "matchCriteriaId": "E3FC6646-2247-4ED9-9643-CD376674E2E7",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.2.2950:build_20241114:*:*:*:*:*:*",
                "matchCriteriaId": "62170342-067D-442C-88FB-64A4BEA8AFE4",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.3.3006:build_20250108:*:*:*:*:*:*",
                "matchCriteriaId": "82464467-E1E6-47E1-BDE5-DDFA52994A47",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.4.3070:build_20250312:*:*:*:*:*:*",
                "matchCriteriaId": "75AE902C-0516-4341-9BF0-21D8803E091C",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.4.3079:build_20250321:*:*:*:*:*:*",
                "matchCriteriaId": "5B005D70-8C91-48D4-B09A-9EBE2E9E5090",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.4.3092:build_20250403:*:*:*:*:*:*",
                "matchCriteriaId": "82FE5F89-A0E1-4D1B-A363-0A0D4141F502",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.5.3145:build_20250526:*:*:*:*:*:*",
                "matchCriteriaId": "B21A9EE0-88D5-42D9-BA21-D55518FCC6E4",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.6.3195:build_20250715:*:*:*:*:*:*",
                "matchCriteriaId": "3B575CF2-21F3-4435-B6B4-61D79B34429C",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.6.3229:build_20250818:*:*:*:*:*:*",
                "matchCriteriaId": "E2EBD305-91E3-4BCC-835B-4878DF4DA3B8",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.7.3256:build_20250913:*:*:*:*:*:*",
                "matchCriteriaId": "554CB021-1477-4E63-8EBA-74056B4D8DA7",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.7.3297:build_20251024:*:*:*:*:*:*",
                "matchCriteriaId": "153F90E1-A54F-4B8D-AEEA-4643421AFF7F",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      },
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2737:build_20240417:*:*:*:*:*:*",
                "matchCriteriaId": "CDCBB36A-CB91-4BA3-A6ED-952E6A4A0481",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2782:build_20240601:*:*:*:*:*:*",
                "matchCriteriaId": "240BCFF1-CCCB-4C07-8E2C-7F43F68407FC",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2789:build_20240607:*:*:*:*:*:*",
                "matchCriteriaId": "D3AF7276-77E0-474A-B10F-AC15BC5FCF00",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2802:build_20240620:*:*:*:*:*:*",
                "matchCriteriaId": "5FA8C3EC-B6C0-44A8-BC91-18E3E90C63AB",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2823:build_20240711:*:*:*:*:*:*",
                "matchCriteriaId": "889336D2-D9F7-4CC0-A22F-B837B5E77751",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2851:build_20240808:*:*:*:*:*:*",
                "matchCriteriaId": "98F72EB9-0EE3-416A-B9BB-2512F5203A5A",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2860:build_20240817:*:*:*:*:*:*",
                "matchCriteriaId": "9110382F-57C2-4C2E-82D1-3246C882B2C3",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.1.2929:build_20241025:*:*:*:*:*:*",
                "matchCriteriaId": "DB92EFD7-47DD-4AAC-97BD-A2D4918FF4ED",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.1.2940:build_20241105:*:*:*:*:*:*",
                "matchCriteriaId": "78E38E23-1AD0-49E1-89FA-73DC2F496137",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.2.2952:build_20241116:*:*:*:*:*:*",
                "matchCriteriaId": "F2F302B6-26CC-4044-B480-4EBDBB90797F",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.3.3006:build_20250108:*:*:*:*:*:*",
                "matchCriteriaId": "BF0093B6-8D38-4D1E-AD71-79299123C2B1",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.4.3070:build_20250312:*:*:*:*:*:*",
                "matchCriteriaId": "48A3CDAA-B0C6-4280-B1AC-DDD027F9D632",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.4.3079:build_20250321:*:*:*:*:*:*",
                "matchCriteriaId": "1807DE4F-CDF3-4E3B-ADC1-9535EF1D60FE",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.5.3138:build_20250519:*:*:*:*:*:*",
                "matchCriteriaId": "68FF7342-A0AF-4E75-9CD6-D584B450B8AB",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.6.3195:build_20250715:*:*:*:*:*:*",
                "matchCriteriaId": "A8E84E3D-943C-4DF5-86D3-DCAC3C034B81",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.7.3256:build_20250913:*:*:*:*:*:*",
                "matchCriteriaId": "17720E05-1BBF-4605-A777-FA4059B3C2DC",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.7.3297:build_20251024:*:*:*:*:*:*",
                "matchCriteriaId": "39CB5F1C-9811-499D-9D32-34B40E0D475E",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.3.0.3115:build_20250430:*:*:*:*:*:*",
                "matchCriteriaId": "4175C7F7-E946-41C6-8863-E23233B91A2B",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.3.0.3145:build_20250530:*:*:*:*:*:*",
                "matchCriteriaId": "DE16C73E-9291-44FD-A9CB-B7C127E67A6F",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.3.0.3192:build_20250716:*:*:*:*:*:*",
                "matchCriteriaId": "ED4023E4-6C28-413A-B7B1-6CEEBC48A1C0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to modify memory or crash processes.\n\nWe have already fixed the vulnerability in the following version:\nQTS 5.2.8.3332 build 20251128 and later"
      },
      {
        "lang": "es",
        "value": "Se ha informado de una vulnerabilidad de desbordamiento de búfer que afecta a varias versiones del sistema operativo QNAP. Si un atacante remoto obtiene una cuenta de administrador, puede entonces explotar la vulnerabilidad para modificar la memoria o bloquear procesos.\n\nYa hemos corregido la vulnerabilidad en la siguiente versión:\nQTS 5.2.8.3332 build 20251128 y posteriores"
      }
    ],
    "id": "CVE-2025-62852",
    "lastModified": "2026-09-30T23:10:00.237",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.2,
          "impactScore": 5.2,
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ],
      "cvssMetricV40": [
        {
          "cvssData": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "availabilityRequirement": "NOT_DEFINED",
            "baseScore": 1.2,
            "baseSeverity": "LOW",
            "confidentialityRequirement": "NOT_DEFINED",
            "exploitMaturity": "UNREPORTED",
            "integrityRequirement": "NOT_DEFINED",
            "modifiedAttackComplexity": "NOT_DEFINED",
            "modifiedAttackRequirements": "NOT_DEFINED",
            "modifiedAttackVector": "NOT_DEFINED",
            "modifiedPrivilegesRequired": "NOT_DEFINED",
            "modifiedSubAvailabilityImpact": "NOT_DEFINED",
            "modifiedSubConfidentialityImpact": "NOT_DEFINED",
            "modifiedSubIntegrityImpact": "NOT_DEFINED",
            "modifiedUserInteraction": "NOT_DEFINED",
            "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
            "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
            "modifiedVulnIntegrityImpact": "NOT_DEFINED",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "source": "security@qnapsecurity.com.tw",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-62852",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-01-05T20:30:25.428565Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-01-02T16:17:00.850",
    "references": [
      {
        "source": "security@qnapsecurity.com.tw",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://www.qnap.com/en/security-advisory/qsa-25-51"
      }
    ],
    "sourceIdentifier": "security@qnapsecurity.com.tw",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-121"
          }
        ],
        "source": "security@qnapsecurity.com.tw",
        "type": "Secondary"
      },
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-787"
          }
        ],
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  }
}

—

Product

product

NVD

QTS

receipt

Source: NVD
Its words: QTS
Read by: field:cve.affected[].affectedData[].product
Said since: 2026-10-02 12:00 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "QTS",
            "vendor": "QNAP Systems Inc.",
            "versions": [
              {
                "lessThan": "5.2.8.3332 build 20251128",
                "status": "affected",
                "version": "5.2.x",
                "versionType": "custom"
              }
            ]
          }
        ],
        "source": "security@qnapsecurity.com.tw"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2737:build_20240417:*:*:*:*:*:*",
                "matchCriteriaId": "F4026A4B-7AB4-48EA-971D-88DFDD3F01A7",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2744:build_20240424:*:*:*:*:*:*",
                "matchCriteriaId": "1F3F99BB-0D68-4D74-92C8-59E24F96C50D",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2782:build_20240601:*:*:*:*:*:*",
                "matchCriteriaId": "1DE63B4D-8E84-41D3-B1F3-04AE6040242B",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2802:build_20240620:*:*:*:*:*:*",
                "matchCriteriaId": "75746563-C648-4E55-9126-703F915F8B8A",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2823:build_20240711:*:*:*:*:*:*",
                "matchCriteriaId": "AF6BA027-A635-4E90-80C8-130B10AB3D23",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2851:build_20240808:*:*:*:*:*:*",
                "matchCriteriaId": "5406F242-A215-4B07-809F-7A7CE55ACE71",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2860:build_20240817:*:*:*:*:*:*",
                "matchCriteriaId": "FA17778E-B3B1-44DD-B4E9-5AD25A3E804C",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.1.2930:build_20241025:*:*:*:*:*:*",
                "matchCriteriaId": "E3FC6646-2247-4ED9-9643-CD376674E2E7",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.2.2950:build_20241114:*:*:*:*:*:*",
                "matchCriteriaId": "62170342-067D-442C-88FB-64A4BEA8AFE4",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.3.3006:build_20250108:*:*:*:*:*:*",
                "matchCriteriaId": "82464467-E1E6-47E1-BDE5-DDFA52994A47",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.4.3070:build_20250312:*:*:*:*:*:*",
                "matchCriteriaId": "75AE902C-0516-4341-9BF0-21D8803E091C",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.4.3079:build_20250321:*:*:*:*:*:*",
                "matchCriteriaId": "5B005D70-8C91-48D4-B09A-9EBE2E9E5090",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.4.3092:build_20250403:*:*:*:*:*:*",
                "matchCriteriaId": "82FE5F89-A0E1-4D1B-A363-0A0D4141F502",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.5.3145:build_20250526:*:*:*:*:*:*",
                "matchCriteriaId": "B21A9EE0-88D5-42D9-BA21-D55518FCC6E4",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.6.3195:build_20250715:*:*:*:*:*:*",
                "matchCriteriaId": "3B575CF2-21F3-4435-B6B4-61D79B34429C",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.6.3229:build_20250818:*:*:*:*:*:*",
                "matchCriteriaId": "E2EBD305-91E3-4BCC-835B-4878DF4DA3B8",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.7.3256:build_20250913:*:*:*:*:*:*",
                "matchCriteriaId": "554CB021-1477-4E63-8EBA-74056B4D8DA7",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.7.3297:build_20251024:*:*:*:*:*:*",
                "matchCriteriaId": "153F90E1-A54F-4B8D-AEEA-4643421AFF7F",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      },
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2737:build_20240417:*:*:*:*:*:*",
                "matchCriteriaId": "CDCBB36A-CB91-4BA3-A6ED-952E6A4A0481",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2782:build_20240601:*:*:*:*:*:*",
                "matchCriteriaId": "240BCFF1-CCCB-4C07-8E2C-7F43F68407FC",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2789:build_20240607:*:*:*:*:*:*",
                "matchCriteriaId": "D3AF7276-77E0-474A-B10F-AC15BC5FCF00",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2802:build_20240620:*:*:*:*:*:*",
                "matchCriteriaId": "5FA8C3EC-B6C0-44A8-BC91-18E3E90C63AB",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2823:build_20240711:*:*:*:*:*:*",
                "matchCriteriaId": "889336D2-D9F7-4CC0-A22F-B837B5E77751",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2851:build_20240808:*:*:*:*:*:*",
                "matchCriteriaId": "98F72EB9-0EE3-416A-B9BB-2512F5203A5A",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2860:build_20240817:*:*:*:*:*:*",
                "matchCriteriaId": "9110382F-57C2-4C2E-82D1-3246C882B2C3",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.1.2929:build_20241025:*:*:*:*:*:*",
                "matchCriteriaId": "DB92EFD7-47DD-4AAC-97BD-A2D4918FF4ED",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.1.2940:build_20241105:*:*:*:*:*:*",
                "matchCriteriaId": "78E38E23-1AD0-49E1-89FA-73DC2F496137",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.2.2952:build_20241116:*:*:*:*:*:*",
                "matchCriteriaId": "F2F302B6-26CC-4044-B480-4EBDBB90797F",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.3.3006:build_20250108:*:*:*:*:*:*",
                "matchCriteriaId": "BF0093B6-8D38-4D1E-AD71-79299123C2B1",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.4.3070:build_20250312:*:*:*:*:*:*",
                "matchCriteriaId": "48A3CDAA-B0C6-4280-B1AC-DDD027F9D632",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.4.3079:build_20250321:*:*:*:*:*:*",
                "matchCriteriaId": "1807DE4F-CDF3-4E3B-ADC1-9535EF1D60FE",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.5.3138:build_20250519:*:*:*:*:*:*",
                "matchCriteriaId": "68FF7342-A0AF-4E75-9CD6-D584B450B8AB",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.6.3195:build_20250715:*:*:*:*:*:*",
                "matchCriteriaId": "A8E84E3D-943C-4DF5-86D3-DCAC3C034B81",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.7.3256:build_20250913:*:*:*:*:*:*",
                "matchCriteriaId": "17720E05-1BBF-4605-A777-FA4059B3C2DC",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.7.3297:build_20251024:*:*:*:*:*:*",
                "matchCriteriaId": "39CB5F1C-9811-499D-9D32-34B40E0D475E",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.3.0.3115:build_20250430:*:*:*:*:*:*",
                "matchCriteriaId": "4175C7F7-E946-41C6-8863-E23233B91A2B",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.3.0.3145:build_20250530:*:*:*:*:*:*",
                "matchCriteriaId": "DE16C73E-9291-44FD-A9CB-B7C127E67A6F",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.3.0.3192:build_20250716:*:*:*:*:*:*",
                "matchCriteriaId": "ED4023E4-6C28-413A-B7B1-6CEEBC48A1C0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to modify memory or crash processes.\n\nWe have already fixed the vulnerability in the following version:\nQTS 5.2.8.3332 build 20251128 and later"
      },
      {
        "lang": "es",
        "value": "Se ha informado de una vulnerabilidad de desbordamiento de búfer que afecta a varias versiones del sistema operativo QNAP. Si un atacante remoto obtiene una cuenta de administrador, puede entonces explotar la vulnerabilidad para modificar la memoria o bloquear procesos.\n\nYa hemos corregido la vulnerabilidad en la siguiente versión:\nQTS 5.2.8.3332 build 20251128 y posteriores"
      }
    ],
    "id": "CVE-2025-62852",
    "lastModified": "2026-09-30T23:10:00.237",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.2,
          "impactScore": 5.2,
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ],
      "cvssMetricV40": [
        {
          "cvssData": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "availabilityRequirement": "NOT_DEFINED",
            "baseScore": 1.2,
            "baseSeverity": "LOW",
            "confidentialityRequirement": "NOT_DEFINED",
            "exploitMaturity": "UNREPORTED",
            "integrityRequirement": "NOT_DEFINED",
            "modifiedAttackComplexity": "NOT_DEFINED",
            "modifiedAttackRequirements": "NOT_DEFINED",
            "modifiedAttackVector": "NOT_DEFINED",
            "modifiedPrivilegesRequired": "NOT_DEFINED",
            "modifiedSubAvailabilityImpact": "NOT_DEFINED",
            "modifiedSubConfidentialityImpact": "NOT_DEFINED",
            "modifiedSubIntegrityImpact": "NOT_DEFINED",
            "modifiedUserInteraction": "NOT_DEFINED",
            "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
            "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
            "modifiedVulnIntegrityImpact": "NOT_DEFINED",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "source": "security@qnapsecurity.com.tw",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-62852",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-01-05T20:30:25.428565Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-01-02T16:17:00.850",
    "references": [
      {
        "source": "security@qnapsecurity.com.tw",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://www.qnap.com/en/security-advisory/qsa-25-51"
      }
    ],
    "sourceIdentifier": "security@qnapsecurity.com.tw",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-121"
          }
        ],
        "source": "security@qnapsecurity.com.tw",
        "type": "Secondary"
      },
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-787"
          }
        ],
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  }
}

—

Severity

severity

NVD

MEDIUM

From 4.0 to 6.9.

receipt

Source: NVD
Its words: MEDIUM
Read by: field:cve.metrics.cvssMetricV31[type=Primary].cvssData.baseSeverity || field:cve.metrics.cvssMetricV31[].cvssData.baseSeverity
Said since: 2026-10-06 12:29 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-10-06 12:29 UTC	MEDIUM
2026-10-02 12:00 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "QTS",
            "vendor": "QNAP Systems Inc.",
            "versions": [
              {
                "lessThan": "5.2.8.3332 build 20251128",
                "status": "affected",
                "version": "5.2.x",
                "versionType": "custom"
              }
            ]
          }
        ],
        "source": "security@qnapsecurity.com.tw"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2737:build_20240417:*:*:*:*:*:*",
                "matchCriteriaId": "F4026A4B-7AB4-48EA-971D-88DFDD3F01A7",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2744:build_20240424:*:*:*:*:*:*",
                "matchCriteriaId": "1F3F99BB-0D68-4D74-92C8-59E24F96C50D",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2782:build_20240601:*:*:*:*:*:*",
                "matchCriteriaId": "1DE63B4D-8E84-41D3-B1F3-04AE6040242B",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2802:build_20240620:*:*:*:*:*:*",
                "matchCriteriaId": "75746563-C648-4E55-9126-703F915F8B8A",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2823:build_20240711:*:*:*:*:*:*",
                "matchCriteriaId": "AF6BA027-A635-4E90-80C8-130B10AB3D23",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2851:build_20240808:*:*:*:*:*:*",
                "matchCriteriaId": "5406F242-A215-4B07-809F-7A7CE55ACE71",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2860:build_20240817:*:*:*:*:*:*",
                "matchCriteriaId": "FA17778E-B3B1-44DD-B4E9-5AD25A3E804C",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.1.2930:build_20241025:*:*:*:*:*:*",
                "matchCriteriaId": "E3FC6646-2247-4ED9-9643-CD376674E2E7",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.2.2950:build_20241114:*:*:*:*:*:*",
                "matchCriteriaId": "62170342-067D-442C-88FB-64A4BEA8AFE4",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.3.3006:build_20250108:*:*:*:*:*:*",
                "matchCriteriaId": "82464467-E1E6-47E1-BDE5-DDFA52994A47",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.4.3070:build_20250312:*:*:*:*:*:*",
                "matchCriteriaId": "75AE902C-0516-4341-9BF0-21D8803E091C",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.4.3079:build_20250321:*:*:*:*:*:*",
                "matchCriteriaId": "5B005D70-8C91-48D4-B09A-9EBE2E9E5090",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.4.3092:build_20250403:*:*:*:*:*:*",
                "matchCriteriaId": "82FE5F89-A0E1-4D1B-A363-0A0D4141F502",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.5.3145:build_20250526:*:*:*:*:*:*",
                "matchCriteriaId": "B21A9EE0-88D5-42D9-BA21-D55518FCC6E4",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.6.3195:build_20250715:*:*:*:*:*:*",
                "matchCriteriaId": "3B575CF2-21F3-4435-B6B4-61D79B34429C",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.6.3229:build_20250818:*:*:*:*:*:*",
                "matchCriteriaId": "E2EBD305-91E3-4BCC-835B-4878DF4DA3B8",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.7.3256:build_20250913:*:*:*:*:*:*",
                "matchCriteriaId": "554CB021-1477-4E63-8EBA-74056B4D8DA7",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.7.3297:build_20251024:*:*:*:*:*:*",
                "matchCriteriaId": "153F90E1-A54F-4B8D-AEEA-4643421AFF7F",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      },
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2737:build_20240417:*:*:*:*:*:*",
                "matchCriteriaId": "CDCBB36A-CB91-4BA3-A6ED-952E6A4A0481",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2782:build_20240601:*:*:*:*:*:*",
                "matchCriteriaId": "240BCFF1-CCCB-4C07-8E2C-7F43F68407FC",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2789:build_20240607:*:*:*:*:*:*",
                "matchCriteriaId": "D3AF7276-77E0-474A-B10F-AC15BC5FCF00",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2802:build_20240620:*:*:*:*:*:*",
                "matchCriteriaId": "5FA8C3EC-B6C0-44A8-BC91-18E3E90C63AB",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2823:build_20240711:*:*:*:*:*:*",
                "matchCriteriaId": "889336D2-D9F7-4CC0-A22F-B837B5E77751",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2851:build_20240808:*:*:*:*:*:*",
                "matchCriteriaId": "98F72EB9-0EE3-416A-B9BB-2512F5203A5A",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2860:build_20240817:*:*:*:*:*:*",
                "matchCriteriaId": "9110382F-57C2-4C2E-82D1-3246C882B2C3",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.1.2929:build_20241025:*:*:*:*:*:*",
                "matchCriteriaId": "DB92EFD7-47DD-4AAC-97BD-A2D4918FF4ED",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.1.2940:build_20241105:*:*:*:*:*:*",
                "matchCriteriaId": "78E38E23-1AD0-49E1-89FA-73DC2F496137",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.2.2952:build_20241116:*:*:*:*:*:*",
                "matchCriteriaId": "F2F302B6-26CC-4044-B480-4EBDBB90797F",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.3.3006:build_20250108:*:*:*:*:*:*",
                "matchCriteriaId": "BF0093B6-8D38-4D1E-AD71-79299123C2B1",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.4.3070:build_20250312:*:*:*:*:*:*",
                "matchCriteriaId": "48A3CDAA-B0C6-4280-B1AC-DDD027F9D632",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.4.3079:build_20250321:*:*:*:*:*:*",
                "matchCriteriaId": "1807DE4F-CDF3-4E3B-ADC1-9535EF1D60FE",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.5.3138:build_20250519:*:*:*:*:*:*",
                "matchCriteriaId": "68FF7342-A0AF-4E75-9CD6-D584B450B8AB",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.6.3195:build_20250715:*:*:*:*:*:*",
                "matchCriteriaId": "A8E84E3D-943C-4DF5-86D3-DCAC3C034B81",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.7.3256:build_20250913:*:*:*:*:*:*",
                "matchCriteriaId": "17720E05-1BBF-4605-A777-FA4059B3C2DC",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.7.3297:build_20251024:*:*:*:*:*:*",
                "matchCriteriaId": "39CB5F1C-9811-499D-9D32-34B40E0D475E",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.3.0.3115:build_20250430:*:*:*:*:*:*",
                "matchCriteriaId": "4175C7F7-E946-41C6-8863-E23233B91A2B",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.3.0.3145:build_20250530:*:*:*:*:*:*",
                "matchCriteriaId": "DE16C73E-9291-44FD-A9CB-B7C127E67A6F",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.3.0.3192:build_20250716:*:*:*:*:*:*",
                "matchCriteriaId": "ED4023E4-6C28-413A-B7B1-6CEEBC48A1C0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to modify memory or crash processes.\n\nWe have already fixed the vulnerability in the following version:\nQTS 5.2.8.3332 build 20251128 and later"
      },
      {
        "lang": "es",
        "value": "Se ha informado de una vulnerabilidad de desbordamiento de búfer que afecta a varias versiones del sistema operativo QNAP. Si un atacante remoto obtiene una cuenta de administrador, puede entonces explotar la vulnerabilidad para modificar la memoria o bloquear procesos.\n\nYa hemos corregido la vulnerabilidad en la siguiente versión:\nQTS 5.2.8.3332 build 20251128 y posteriores"
      }
    ],
    "id": "CVE-2025-62852",
    "lastModified": "2026-09-30T23:10:00.237",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.2,
          "impactScore": 5.2,
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ],
      "cvssMetricV40": [
        {
          "cvssData": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "availabilityRequirement": "NOT_DEFINED",
            "baseScore": 1.2,
            "baseSeverity": "LOW",
            "confidentialityRequirement": "NOT_DEFINED",
            "exploitMaturity": "UNREPORTED",
            "integrityRequirement": "NOT_DEFINED",
            "modifiedAttackComplexity": "NOT_DEFINED",
            "modifiedAttackRequirements": "NOT_DEFINED",
            "modifiedAttackVector": "NOT_DEFINED",
            "modifiedPrivilegesRequired": "NOT_DEFINED",
            "modifiedSubAvailabilityImpact": "NOT_DEFINED",
            "modifiedSubConfidentialityImpact": "NOT_DEFINED",
            "modifiedSubIntegrityImpact": "NOT_DEFINED",
            "modifiedUserInteraction": "NOT_DEFINED",
            "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
            "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
            "modifiedVulnIntegrityImpact": "NOT_DEFINED",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "source": "security@qnapsecurity.com.tw",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-62852",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-01-05T20:30:25.428565Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-01-02T16:17:00.850",
    "references": [
      {
        "source": "security@qnapsecurity.com.tw",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://www.qnap.com/en/security-advisory/qsa-25-51"
      }
    ],
    "sourceIdentifier": "security@qnapsecurity.com.tw",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-121"
          }
        ],
        "source": "security@qnapsecurity.com.tw",
        "type": "Secondary"
      },
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-787"
          }
        ],
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  }
}

medium

Status

status

NVD

Analyzed

receipt

Source: NVD
Its words: Analyzed
Read by: field:cve.vulnStatus
Said since: 2026-10-02 12:00 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "QTS",
            "vendor": "QNAP Systems Inc.",
            "versions": [
              {
                "lessThan": "5.2.8.3332 build 20251128",
                "status": "affected",
                "version": "5.2.x",
                "versionType": "custom"
              }
            ]
          }
        ],
        "source": "security@qnapsecurity.com.tw"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2737:build_20240417:*:*:*:*:*:*",
                "matchCriteriaId": "F4026A4B-7AB4-48EA-971D-88DFDD3F01A7",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2744:build_20240424:*:*:*:*:*:*",
                "matchCriteriaId": "1F3F99BB-0D68-4D74-92C8-59E24F96C50D",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2782:build_20240601:*:*:*:*:*:*",
                "matchCriteriaId": "1DE63B4D-8E84-41D3-B1F3-04AE6040242B",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2802:build_20240620:*:*:*:*:*:*",
                "matchCriteriaId": "75746563-C648-4E55-9126-703F915F8B8A",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2823:build_20240711:*:*:*:*:*:*",
                "matchCriteriaId": "AF6BA027-A635-4E90-80C8-130B10AB3D23",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2851:build_20240808:*:*:*:*:*:*",
                "matchCriteriaId": "5406F242-A215-4B07-809F-7A7CE55ACE71",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2860:build_20240817:*:*:*:*:*:*",
                "matchCriteriaId": "FA17778E-B3B1-44DD-B4E9-5AD25A3E804C",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.1.2930:build_20241025:*:*:*:*:*:*",
                "matchCriteriaId": "E3FC6646-2247-4ED9-9643-CD376674E2E7",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.2.2950:build_20241114:*:*:*:*:*:*",
                "matchCriteriaId": "62170342-067D-442C-88FB-64A4BEA8AFE4",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.3.3006:build_20250108:*:*:*:*:*:*",
                "matchCriteriaId": "82464467-E1E6-47E1-BDE5-DDFA52994A47",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.4.3070:build_20250312:*:*:*:*:*:*",
                "matchCriteriaId": "75AE902C-0516-4341-9BF0-21D8803E091C",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.4.3079:build_20250321:*:*:*:*:*:*",
                "matchCriteriaId": "5B005D70-8C91-48D4-B09A-9EBE2E9E5090",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.4.3092:build_20250403:*:*:*:*:*:*",
                "matchCriteriaId": "82FE5F89-A0E1-4D1B-A363-0A0D4141F502",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.5.3145:build_20250526:*:*:*:*:*:*",
                "matchCriteriaId": "B21A9EE0-88D5-42D9-BA21-D55518FCC6E4",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.6.3195:build_20250715:*:*:*:*:*:*",
                "matchCriteriaId": "3B575CF2-21F3-4435-B6B4-61D79B34429C",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.6.3229:build_20250818:*:*:*:*:*:*",
                "matchCriteriaId": "E2EBD305-91E3-4BCC-835B-4878DF4DA3B8",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.7.3256:build_20250913:*:*:*:*:*:*",
                "matchCriteriaId": "554CB021-1477-4E63-8EBA-74056B4D8DA7",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.7.3297:build_20251024:*:*:*:*:*:*",
                "matchCriteriaId": "153F90E1-A54F-4B8D-AEEA-4643421AFF7F",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      },
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2737:build_20240417:*:*:*:*:*:*",
                "matchCriteriaId": "CDCBB36A-CB91-4BA3-A6ED-952E6A4A0481",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2782:build_20240601:*:*:*:*:*:*",
                "matchCriteriaId": "240BCFF1-CCCB-4C07-8E2C-7F43F68407FC",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2789:build_20240607:*:*:*:*:*:*",
                "matchCriteriaId": "D3AF7276-77E0-474A-B10F-AC15BC5FCF00",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2802:build_20240620:*:*:*:*:*:*",
                "matchCriteriaId": "5FA8C3EC-B6C0-44A8-BC91-18E3E90C63AB",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2823:build_20240711:*:*:*:*:*:*",
                "matchCriteriaId": "889336D2-D9F7-4CC0-A22F-B837B5E77751",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2851:build_20240808:*:*:*:*:*:*",
                "matchCriteriaId": "98F72EB9-0EE3-416A-B9BB-2512F5203A5A",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2860:build_20240817:*:*:*:*:*:*",
                "matchCriteriaId": "9110382F-57C2-4C2E-82D1-3246C882B2C3",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.1.2929:build_20241025:*:*:*:*:*:*",
                "matchCriteriaId": "DB92EFD7-47DD-4AAC-97BD-A2D4918FF4ED",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.1.2940:build_20241105:*:*:*:*:*:*",
                "matchCriteriaId": "78E38E23-1AD0-49E1-89FA-73DC2F496137",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.2.2952:build_20241116:*:*:*:*:*:*",
                "matchCriteriaId": "F2F302B6-26CC-4044-B480-4EBDBB90797F",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.3.3006:build_20250108:*:*:*:*:*:*",
                "matchCriteriaId": "BF0093B6-8D38-4D1E-AD71-79299123C2B1",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.4.3070:build_20250312:*:*:*:*:*:*",
                "matchCriteriaId": "48A3CDAA-B0C6-4280-B1AC-DDD027F9D632",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.4.3079:build_20250321:*:*:*:*:*:*",
                "matchCriteriaId": "1807DE4F-CDF3-4E3B-ADC1-9535EF1D60FE",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.5.3138:build_20250519:*:*:*:*:*:*",
                "matchCriteriaId": "68FF7342-A0AF-4E75-9CD6-D584B450B8AB",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.6.3195:build_20250715:*:*:*:*:*:*",
                "matchCriteriaId": "A8E84E3D-943C-4DF5-86D3-DCAC3C034B81",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.7.3256:build_20250913:*:*:*:*:*:*",
                "matchCriteriaId": "17720E05-1BBF-4605-A777-FA4059B3C2DC",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.7.3297:build_20251024:*:*:*:*:*:*",
                "matchCriteriaId": "39CB5F1C-9811-499D-9D32-34B40E0D475E",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.3.0.3115:build_20250430:*:*:*:*:*:*",
                "matchCriteriaId": "4175C7F7-E946-41C6-8863-E23233B91A2B",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.3.0.3145:build_20250530:*:*:*:*:*:*",
                "matchCriteriaId": "DE16C73E-9291-44FD-A9CB-B7C127E67A6F",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.3.0.3192:build_20250716:*:*:*:*:*:*",
                "matchCriteriaId": "ED4023E4-6C28-413A-B7B1-6CEEBC48A1C0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to modify memory or crash processes.\n\nWe have already fixed the vulnerability in the following version:\nQTS 5.2.8.3332 build 20251128 and later"
      },
      {
        "lang": "es",
        "value": "Se ha informado de una vulnerabilidad de desbordamiento de búfer que afecta a varias versiones del sistema operativo QNAP. Si un atacante remoto obtiene una cuenta de administrador, puede entonces explotar la vulnerabilidad para modificar la memoria o bloquear procesos.\n\nYa hemos corregido la vulnerabilidad en la siguiente versión:\nQTS 5.2.8.3332 build 20251128 y posteriores"
      }
    ],
    "id": "CVE-2025-62852",
    "lastModified": "2026-09-30T23:10:00.237",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.2,
          "impactScore": 5.2,
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ],
      "cvssMetricV40": [
        {
          "cvssData": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "availabilityRequirement": "NOT_DEFINED",
            "baseScore": 1.2,
            "baseSeverity": "LOW",
            "confidentialityRequirement": "NOT_DEFINED",
            "exploitMaturity": "UNREPORTED",
            "integrityRequirement": "NOT_DEFINED",
            "modifiedAttackComplexity": "NOT_DEFINED",
            "modifiedAttackRequirements": "NOT_DEFINED",
            "modifiedAttackVector": "NOT_DEFINED",
            "modifiedPrivilegesRequired": "NOT_DEFINED",
            "modifiedSubAvailabilityImpact": "NOT_DEFINED",
            "modifiedSubConfidentialityImpact": "NOT_DEFINED",
            "modifiedSubIntegrityImpact": "NOT_DEFINED",
            "modifiedUserInteraction": "NOT_DEFINED",
            "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
            "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
            "modifiedVulnIntegrityImpact": "NOT_DEFINED",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "source": "security@qnapsecurity.com.tw",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-62852",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-01-05T20:30:25.428565Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-01-02T16:17:00.850",
    "references": [
      {
        "source": "security@qnapsecurity.com.tw",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://www.qnap.com/en/security-advisory/qsa-25-51"
      }
    ],
    "sourceIdentifier": "security@qnapsecurity.com.tw",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-121"
          }
        ],
        "source": "security@qnapsecurity.com.tw",
        "type": "Secondary"
      },
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-787"
          }
        ],
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  }
}

—

Technical impact

technical_impact

NVD

partial

The attacker gains limited control, or limited information.

receipt

Source: NVD
Its words: partial
Read by: field:cve.metrics.ssvcV203[].ssvcData.options[].technicalImpact
Said since: 2026-10-06 12:29 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-10-06 12:29 UTC	partial
2026-10-02 12:00 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "QTS",
            "vendor": "QNAP Systems Inc.",
            "versions": [
              {
                "lessThan": "5.2.8.3332 build 20251128",
                "status": "affected",
                "version": "5.2.x",
                "versionType": "custom"
              }
            ]
          }
        ],
        "source": "security@qnapsecurity.com.tw"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2737:build_20240417:*:*:*:*:*:*",
                "matchCriteriaId": "F4026A4B-7AB4-48EA-971D-88DFDD3F01A7",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2744:build_20240424:*:*:*:*:*:*",
                "matchCriteriaId": "1F3F99BB-0D68-4D74-92C8-59E24F96C50D",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2782:build_20240601:*:*:*:*:*:*",
                "matchCriteriaId": "1DE63B4D-8E84-41D3-B1F3-04AE6040242B",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2802:build_20240620:*:*:*:*:*:*",
                "matchCriteriaId": "75746563-C648-4E55-9126-703F915F8B8A",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2823:build_20240711:*:*:*:*:*:*",
                "matchCriteriaId": "AF6BA027-A635-4E90-80C8-130B10AB3D23",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2851:build_20240808:*:*:*:*:*:*",
                "matchCriteriaId": "5406F242-A215-4B07-809F-7A7CE55ACE71",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2860:build_20240817:*:*:*:*:*:*",
                "matchCriteriaId": "FA17778E-B3B1-44DD-B4E9-5AD25A3E804C",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.1.2930:build_20241025:*:*:*:*:*:*",
                "matchCriteriaId": "E3FC6646-2247-4ED9-9643-CD376674E2E7",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.2.2950:build_20241114:*:*:*:*:*:*",
                "matchCriteriaId": "62170342-067D-442C-88FB-64A4BEA8AFE4",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.3.3006:build_20250108:*:*:*:*:*:*",
                "matchCriteriaId": "82464467-E1E6-47E1-BDE5-DDFA52994A47",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.4.3070:build_20250312:*:*:*:*:*:*",
                "matchCriteriaId": "75AE902C-0516-4341-9BF0-21D8803E091C",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.4.3079:build_20250321:*:*:*:*:*:*",
                "matchCriteriaId": "5B005D70-8C91-48D4-B09A-9EBE2E9E5090",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.4.3092:build_20250403:*:*:*:*:*:*",
                "matchCriteriaId": "82FE5F89-A0E1-4D1B-A363-0A0D4141F502",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.5.3145:build_20250526:*:*:*:*:*:*",
                "matchCriteriaId": "B21A9EE0-88D5-42D9-BA21-D55518FCC6E4",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.6.3195:build_20250715:*:*:*:*:*:*",
                "matchCriteriaId": "3B575CF2-21F3-4435-B6B4-61D79B34429C",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.6.3229:build_20250818:*:*:*:*:*:*",
                "matchCriteriaId": "E2EBD305-91E3-4BCC-835B-4878DF4DA3B8",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.7.3256:build_20250913:*:*:*:*:*:*",
                "matchCriteriaId": "554CB021-1477-4E63-8EBA-74056B4D8DA7",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.7.3297:build_20251024:*:*:*:*:*:*",
                "matchCriteriaId": "153F90E1-A54F-4B8D-AEEA-4643421AFF7F",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      },
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2737:build_20240417:*:*:*:*:*:*",
                "matchCriteriaId": "CDCBB36A-CB91-4BA3-A6ED-952E6A4A0481",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2782:build_20240601:*:*:*:*:*:*",
                "matchCriteriaId": "240BCFF1-CCCB-4C07-8E2C-7F43F68407FC",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2789:build_20240607:*:*:*:*:*:*",
                "matchCriteriaId": "D3AF7276-77E0-474A-B10F-AC15BC5FCF00",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2802:build_20240620:*:*:*:*:*:*",
                "matchCriteriaId": "5FA8C3EC-B6C0-44A8-BC91-18E3E90C63AB",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2823:build_20240711:*:*:*:*:*:*",
                "matchCriteriaId": "889336D2-D9F7-4CC0-A22F-B837B5E77751",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2851:build_20240808:*:*:*:*:*:*",
                "matchCriteriaId": "98F72EB9-0EE3-416A-B9BB-2512F5203A5A",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2860:build_20240817:*:*:*:*:*:*",
                "matchCriteriaId": "9110382F-57C2-4C2E-82D1-3246C882B2C3",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.1.2929:build_20241025:*:*:*:*:*:*",
                "matchCriteriaId": "DB92EFD7-47DD-4AAC-97BD-A2D4918FF4ED",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.1.2940:build_20241105:*:*:*:*:*:*",
                "matchCriteriaId": "78E38E23-1AD0-49E1-89FA-73DC2F496137",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.2.2952:build_20241116:*:*:*:*:*:*",
                "matchCriteriaId": "F2F302B6-26CC-4044-B480-4EBDBB90797F",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.3.3006:build_20250108:*:*:*:*:*:*",
                "matchCriteriaId": "BF0093B6-8D38-4D1E-AD71-79299123C2B1",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.4.3070:build_20250312:*:*:*:*:*:*",
                "matchCriteriaId": "48A3CDAA-B0C6-4280-B1AC-DDD027F9D632",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.4.3079:build_20250321:*:*:*:*:*:*",
                "matchCriteriaId": "1807DE4F-CDF3-4E3B-ADC1-9535EF1D60FE",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.5.3138:build_20250519:*:*:*:*:*:*",
                "matchCriteriaId": "68FF7342-A0AF-4E75-9CD6-D584B450B8AB",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.6.3195:build_20250715:*:*:*:*:*:*",
                "matchCriteriaId": "A8E84E3D-943C-4DF5-86D3-DCAC3C034B81",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.7.3256:build_20250913:*:*:*:*:*:*",
                "matchCriteriaId": "17720E05-1BBF-4605-A777-FA4059B3C2DC",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.7.3297:build_20251024:*:*:*:*:*:*",
                "matchCriteriaId": "39CB5F1C-9811-499D-9D32-34B40E0D475E",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.3.0.3115:build_20250430:*:*:*:*:*:*",
                "matchCriteriaId": "4175C7F7-E946-41C6-8863-E23233B91A2B",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.3.0.3145:build_20250530:*:*:*:*:*:*",
                "matchCriteriaId": "DE16C73E-9291-44FD-A9CB-B7C127E67A6F",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.3.0.3192:build_20250716:*:*:*:*:*:*",
                "matchCriteriaId": "ED4023E4-6C28-413A-B7B1-6CEEBC48A1C0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to modify memory or crash processes.\n\nWe have already fixed the vulnerability in the following version:\nQTS 5.2.8.3332 build 20251128 and later"
      },
      {
        "lang": "es",
        "value": "Se ha informado de una vulnerabilidad de desbordamiento de búfer que afecta a varias versiones del sistema operativo QNAP. Si un atacante remoto obtiene una cuenta de administrador, puede entonces explotar la vulnerabilidad para modificar la memoria o bloquear procesos.\n\nYa hemos corregido la vulnerabilidad en la siguiente versión:\nQTS 5.2.8.3332 build 20251128 y posteriores"
      }
    ],
    "id": "CVE-2025-62852",
    "lastModified": "2026-09-30T23:10:00.237",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.2,
          "impactScore": 5.2,
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ],
      "cvssMetricV40": [
        {
          "cvssData": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "availabilityRequirement": "NOT_DEFINED",
            "baseScore": 1.2,
            "baseSeverity": "LOW",
            "confidentialityRequirement": "NOT_DEFINED",
            "exploitMaturity": "UNREPORTED",
            "integrityRequirement": "NOT_DEFINED",
            "modifiedAttackComplexity": "NOT_DEFINED",
            "modifiedAttackRequirements": "NOT_DEFINED",
            "modifiedAttackVector": "NOT_DEFINED",
            "modifiedPrivilegesRequired": "NOT_DEFINED",
            "modifiedSubAvailabilityImpact": "NOT_DEFINED",
            "modifiedSubConfidentialityImpact": "NOT_DEFINED",
            "modifiedSubIntegrityImpact": "NOT_DEFINED",
            "modifiedUserInteraction": "NOT_DEFINED",
            "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
            "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
            "modifiedVulnIntegrityImpact": "NOT_DEFINED",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "source": "security@qnapsecurity.com.tw",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-62852",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-01-05T20:30:25.428565Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-01-02T16:17:00.850",
    "references": [
      {
        "source": "security@qnapsecurity.com.tw",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://www.qnap.com/en/security-advisory/qsa-25-51"
      }
    ],
    "sourceIdentifier": "security@qnapsecurity.com.tw",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-121"
          }
        ],
        "source": "security@qnapsecurity.com.tw",
        "type": "Secondary"
      },
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-787"
          }
        ],
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  }
}

—

Vendor

vendor

NVD

QNAP Systems Inc.

receipt

Source: NVD
Its words: QNAP Systems Inc.
Read by: field:cve.affected[].affectedData[].vendor
Said since: 2026-10-02 12:00 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "QTS",
            "vendor": "QNAP Systems Inc.",
            "versions": [
              {
                "lessThan": "5.2.8.3332 build 20251128",
                "status": "affected",
                "version": "5.2.x",
                "versionType": "custom"
              }
            ]
          }
        ],
        "source": "security@qnapsecurity.com.tw"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2737:build_20240417:*:*:*:*:*:*",
                "matchCriteriaId": "F4026A4B-7AB4-48EA-971D-88DFDD3F01A7",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2744:build_20240424:*:*:*:*:*:*",
                "matchCriteriaId": "1F3F99BB-0D68-4D74-92C8-59E24F96C50D",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2782:build_20240601:*:*:*:*:*:*",
                "matchCriteriaId": "1DE63B4D-8E84-41D3-B1F3-04AE6040242B",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2802:build_20240620:*:*:*:*:*:*",
                "matchCriteriaId": "75746563-C648-4E55-9126-703F915F8B8A",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2823:build_20240711:*:*:*:*:*:*",
                "matchCriteriaId": "AF6BA027-A635-4E90-80C8-130B10AB3D23",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2851:build_20240808:*:*:*:*:*:*",
                "matchCriteriaId": "5406F242-A215-4B07-809F-7A7CE55ACE71",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.0.2860:build_20240817:*:*:*:*:*:*",
                "matchCriteriaId": "FA17778E-B3B1-44DD-B4E9-5AD25A3E804C",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.1.2930:build_20241025:*:*:*:*:*:*",
                "matchCriteriaId": "E3FC6646-2247-4ED9-9643-CD376674E2E7",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.2.2950:build_20241114:*:*:*:*:*:*",
                "matchCriteriaId": "62170342-067D-442C-88FB-64A4BEA8AFE4",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.3.3006:build_20250108:*:*:*:*:*:*",
                "matchCriteriaId": "82464467-E1E6-47E1-BDE5-DDFA52994A47",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.4.3070:build_20250312:*:*:*:*:*:*",
                "matchCriteriaId": "75AE902C-0516-4341-9BF0-21D8803E091C",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.4.3079:build_20250321:*:*:*:*:*:*",
                "matchCriteriaId": "5B005D70-8C91-48D4-B09A-9EBE2E9E5090",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.4.3092:build_20250403:*:*:*:*:*:*",
                "matchCriteriaId": "82FE5F89-A0E1-4D1B-A363-0A0D4141F502",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.5.3145:build_20250526:*:*:*:*:*:*",
                "matchCriteriaId": "B21A9EE0-88D5-42D9-BA21-D55518FCC6E4",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.6.3195:build_20250715:*:*:*:*:*:*",
                "matchCriteriaId": "3B575CF2-21F3-4435-B6B4-61D79B34429C",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.6.3229:build_20250818:*:*:*:*:*:*",
                "matchCriteriaId": "E2EBD305-91E3-4BCC-835B-4878DF4DA3B8",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.7.3256:build_20250913:*:*:*:*:*:*",
                "matchCriteriaId": "554CB021-1477-4E63-8EBA-74056B4D8DA7",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:qts:5.2.7.3297:build_20251024:*:*:*:*:*:*",
                "matchCriteriaId": "153F90E1-A54F-4B8D-AEEA-4643421AFF7F",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      },
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2737:build_20240417:*:*:*:*:*:*",
                "matchCriteriaId": "CDCBB36A-CB91-4BA3-A6ED-952E6A4A0481",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2782:build_20240601:*:*:*:*:*:*",
                "matchCriteriaId": "240BCFF1-CCCB-4C07-8E2C-7F43F68407FC",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2789:build_20240607:*:*:*:*:*:*",
                "matchCriteriaId": "D3AF7276-77E0-474A-B10F-AC15BC5FCF00",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2802:build_20240620:*:*:*:*:*:*",
                "matchCriteriaId": "5FA8C3EC-B6C0-44A8-BC91-18E3E90C63AB",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2823:build_20240711:*:*:*:*:*:*",
                "matchCriteriaId": "889336D2-D9F7-4CC0-A22F-B837B5E77751",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2851:build_20240808:*:*:*:*:*:*",
                "matchCriteriaId": "98F72EB9-0EE3-416A-B9BB-2512F5203A5A",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.0.2860:build_20240817:*:*:*:*:*:*",
                "matchCriteriaId": "9110382F-57C2-4C2E-82D1-3246C882B2C3",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.1.2929:build_20241025:*:*:*:*:*:*",
                "matchCriteriaId": "DB92EFD7-47DD-4AAC-97BD-A2D4918FF4ED",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.1.2940:build_20241105:*:*:*:*:*:*",
                "matchCriteriaId": "78E38E23-1AD0-49E1-89FA-73DC2F496137",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.2.2952:build_20241116:*:*:*:*:*:*",
                "matchCriteriaId": "F2F302B6-26CC-4044-B480-4EBDBB90797F",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.3.3006:build_20250108:*:*:*:*:*:*",
                "matchCriteriaId": "BF0093B6-8D38-4D1E-AD71-79299123C2B1",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.4.3070:build_20250312:*:*:*:*:*:*",
                "matchCriteriaId": "48A3CDAA-B0C6-4280-B1AC-DDD027F9D632",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.4.3079:build_20250321:*:*:*:*:*:*",
                "matchCriteriaId": "1807DE4F-CDF3-4E3B-ADC1-9535EF1D60FE",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.5.3138:build_20250519:*:*:*:*:*:*",
                "matchCriteriaId": "68FF7342-A0AF-4E75-9CD6-D584B450B8AB",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.6.3195:build_20250715:*:*:*:*:*:*",
                "matchCriteriaId": "A8E84E3D-943C-4DF5-86D3-DCAC3C034B81",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.7.3256:build_20250913:*:*:*:*:*:*",
                "matchCriteriaId": "17720E05-1BBF-4605-A777-FA4059B3C2DC",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.2.7.3297:build_20251024:*:*:*:*:*:*",
                "matchCriteriaId": "39CB5F1C-9811-499D-9D32-34B40E0D475E",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.3.0.3115:build_20250430:*:*:*:*:*:*",
                "matchCriteriaId": "4175C7F7-E946-41C6-8863-E23233B91A2B",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.3.0.3145:build_20250530:*:*:*:*:*:*",
                "matchCriteriaId": "DE16C73E-9291-44FD-A9CB-B7C127E67A6F",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:qnap:quts_hero:h5.3.0.3192:build_20250716:*:*:*:*:*:*",
                "matchCriteriaId": "ED4023E4-6C28-413A-B7B1-6CEEBC48A1C0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to modify memory or crash processes.\n\nWe have already fixed the vulnerability in the following version:\nQTS 5.2.8.3332 build 20251128 and later"
      },
      {
        "lang": "es",
        "value": "Se ha informado de una vulnerabilidad de desbordamiento de búfer que afecta a varias versiones del sistema operativo QNAP. Si un atacante remoto obtiene una cuenta de administrador, puede entonces explotar la vulnerabilidad para modificar la memoria o bloquear procesos.\n\nYa hemos corregido la vulnerabilidad en la siguiente versión:\nQTS 5.2.8.3332 build 20251128 y posteriores"
      }
    ],
    "id": "CVE-2025-62852",
    "lastModified": "2026-09-30T23:10:00.237",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.2,
          "impactScore": 5.2,
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ],
      "cvssMetricV40": [
        {
          "cvssData": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "availabilityRequirement": "NOT_DEFINED",
            "baseScore": 1.2,
            "baseSeverity": "LOW",
            "confidentialityRequirement": "NOT_DEFINED",
            "exploitMaturity": "UNREPORTED",
            "integrityRequirement": "NOT_DEFINED",
            "modifiedAttackComplexity": "NOT_DEFINED",
            "modifiedAttackRequirements": "NOT_DEFINED",
            "modifiedAttackVector": "NOT_DEFINED",
            "modifiedPrivilegesRequired": "NOT_DEFINED",
            "modifiedSubAvailabilityImpact": "NOT_DEFINED",
            "modifiedSubConfidentialityImpact": "NOT_DEFINED",
            "modifiedSubIntegrityImpact": "NOT_DEFINED",
            "modifiedUserInteraction": "NOT_DEFINED",
            "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
            "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
            "modifiedVulnIntegrityImpact": "NOT_DEFINED",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "source": "security@qnapsecurity.com.tw",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-62852",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-01-05T20:30:25.428565Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-01-02T16:17:00.850",
    "references": [
      {
        "source": "security@qnapsecurity.com.tw",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://www.qnap.com/en/security-advisory/qsa-25-51"
      }
    ],
    "sourceIdentifier": "security@qnapsecurity.com.tw",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-121"
          }
        ],
        "source": "security@qnapsecurity.com.tw",
        "type": "Secondary"
      },
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-787"
          }
        ],
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  }
}

—

Every claim, by kind

vulnerability

zetlyn/cve-nvd · 2026-01-02

automatable no cvss 6.5 cvss4 1.2 cvss4_vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X cvss_vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H cwe CWE-121, CWE-787 exploitation none product QTS severity MEDIUM status Analyzed technical_impact partial vendor QNAP Systems Inc.

source