CVE-2025-22481

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained user access to execute arbitrary commands.

We have already fixed the vulnerability in the following versions: QTS 5.2.4.3079 build 20250321 and later QuTS hero h5.2.4.3079 build 20250321 and later

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77 CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Jun 6, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-224828.1A use of externally-controlled format string vulnerability has been reported to affect Qsync Central. If exploited, the vulnerability could CVE-2025-224834.8A cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an CVE-2025-224847.1An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gain CVE-2025-224868.8An improper certificate validation vulnerability has been reported to affect File Station 5. If exploited, the vulnerability could allow rem CVE-2025-22498.8The SoJ SoundSlides plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the soj_soundslides_CVE-2025-224907.5A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can th CVE-2025-224916.7The user input was not sanitized on Reporting Hierarchy Management page of Foreseer Reporting Software (FRS) application which could lead in CVE-2025-224926.3The connection string visible to users with access to FRSCore database on Foreseer Reporting Software (FRS) VM, this string can be used for CVE-2025-224935.6Secure flag not set and SameSIte was set to Lax in the Foreseer Reporting Software (FRS). Absence of this secure flag could lead into the se CVE-2025-224958.4An improper input validation vulnerability was discovered in the NTP server configuration field of the Network-M2 card. This could result in CVE-2025-224965.9Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MarMar8x Notif Bell notif-bell allows CVE-2025-224976.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bramwaas Simple Google Calendar Outloo