Vulnerabilitycritical
QNAP fixed four vulnerabilities demonstrated at Pwn2Own Ireland 2025
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-11837 | An improper control of generation of code vulnerability has been reported to affect Malware Remover | 8.1 | 1% | ||
| CVE-2025-59389 | An SQL injection vulnerability has been reported to affect Hyper Data Protector | 8.1 | <1% | ||
CVE-2025-62842+1 related CVE | An external control of file name or path vulnerability has been reported to affect HBS 3 Hybrid Backup Sync | 7.0 | <1% | ||
CVE-2025-62846+3 related CVEs | An SQL injection vulnerability has been reported to affect QHora | 7.3 group max | <1% | ||
CVE-2025-62848+2 related CVEs | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions | 8.1 group max | <1% |
From the original article
2 min read at securityaffairs.comQNAP fixed four vulnerabilities shown at Pwn2Own 2025 that could enable code execution, data access, or system disruption. Taiwanese vendor QNAP has addressed multiple vulnerabilities , including four SD-WAN router issues (CVE-2025-62843 to CVE-2025-62846) demonstrated at the Pwn2Own Ireland 2025 by Team DDOS. The team chained multiple bugs in QNAP devices to gain root access and earned a $100,000 reward.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.