Severe QNAP NAS Zero-Day Flaws Patched After Pwn2Own 2025: What You Should Know

QNAP has released security updates addressing seven zero-day vulnerabilities discovered and demonstrated during Pwn2Own Ireland 2025. The flaws affect QTS , QuTS hero , and several QNAP applications, including Hyper Data Protector, Malware Remover, and HBS 3 Hybrid Backup Sync.

This blog post provides a summary of the recent QNAP NAS zero-day vulnerabilities, their technical details, and the recommended mitigation steps.

Seven distinct zero-day vulnerabilities were exploited during the Pwn2Own competition, affecting core operating systems and apps used across QNAP NAS devices.

The identified CVEs are:

Each flaw was presented live by research teams including Summoning Team, DEVCORE, Team DDOS, and CyCraft.

The main issues stemmed from improper input validation and memory management errors within CGI handlers. In particular, stack-based buffer overflows and use-after-free vulnerabilities allowed attackers to inject commands via the quick.cgi component.

In the context of Malware Remover and HBS 3, these weaknesses extended to path traversal and command injection , which could expose backup files or compromise system scans.

Such attack paths are especially dangerous for enterprises using NAS as centralized file repositories, as they could serve as an entry point for supply-chain attacks or data extortion .

According to the official QNAPadvisories, all seven of the vulnerabilities are rated critical. Successful exploitation can lead to the following outcomes:

In some exploit chains, attackers can also trigger Denial of Service (DoS) conditions by crashing services or destabilizing the system, using outages as a precursor to data theft or extortion. When chained, these bugs enable an external attacker to bypass authentication and operate on the NAS as if they were a trusted administrator.

Get ahead of the zero-day. With SOCRadar’s Cyber Threat Intelligence module , security teams receive actionable vulnerability intelligence with real-time exploit alerts, contextual risk scoring, and vendor patch tracking – all in one unified view.

The Attack Surface Management (ASM) module complements it by mapping exposed assets and identifying which systems are affected by new vulnerabilities, allowing faster remediation and reduced exposure time.

QNAP released patched builds, which addresses all affected components. Users should ensure they are running the following versions, or later:

Beyond immediate patching, QNAP recommends:

Security teams should also integrate intrusion detection or endpoint monitoring to spot exploitation attempts early.

While the QNAP issues focus on storage appliances, another recent disclosure points to broader infrastructure risks. Three serious flaws have been identified in the runC container runtime – the engine powering Docker and Kubernetes – raising concerns container isolation integrity.

The vulnerabilities ( CVE-2025-31133 , CVE-2025-52565 , CVE-2025-52881 ) each carry a CVSS 8.2 rating and could allow container breakouts, granting unauthorized write access to host systems.

Discovered by SUSE engineer Aleksa Sarai, the bugs involve unsafe mount and symlink handling during container initialization. Under specific conditions, writes from the container can be redirected to host paths such as /proc, potentially leading to privilege escalation.

While no active exploitation has been observed, prompt patching is advised to maintain container isolation integrity.

According to Sysdig’s analysis , administrators should enable user namespaces , use rootless containers , and monitor for unusual symlink behavior as preventative measures.