cbcvebase.
CVE-2025-62847
published 2025-12-16

CVE-2025-62847: An improper neutralization of argument delimiters in a command vulnerability has been reported to affect several QNAP operating system versions. The remote…

PriorityP351high7.5CVSS 3.1
AVNACLPRNUINSUCNIHAN
EPSS
0.78%
51.2th percentile
An improper neutralization of argument delimiters in a command vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to alter execution logic. We have already fixed the vulnerability in the following versions: QTS 5.2.7.3297 build 20251024 and later QuTS hero h5.2.7.3297 build 20251024 and later QuTS hero h5.3.1.3292 build 20251024 and later

Affected

40 ranges· showing 25
VendorProductVersion rangeFixed in
qnapqts——
qnapqts——
qnapqts——
qnapqts——
qnapqts——
qnapqts——
qnapqts——
qnapqts——
qnapqts——
qnapqts——
qnapqts——
qnapqts——
qnapqts——
qnapqts——
qnapqts——
qnapqts——
qnapqts——
qnapquts_hero——
qnapquts_hero——
qnapquts_hero——
qnapquts_hero——
qnapquts_hero——
qnapquts_hero——
qnapquts_hero——
qnapquts_hero——

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
nvdv4.06.6MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.