CVE-2025-54154

MediumCVSS 6.8/10Last modified Oct 18, 2026

Description

An improper authentication vulnerability has been reported to affect QNAP Authenticator. If an attacker gains physical access, they can then exploit the vulnerability to compromise the security of the system.

We have already fixed the vulnerability in the following version: QNAP Authenticator 1.3.1.1227 and later

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

No affected versions have been published.

Timeline

Published
Oct 3, 2025
Last modified
Oct 18, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-541554.9An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gainsCVE-2025-541567.5The Sante PACS Server Web Portal sends credential information without encryption.CVE-2025-541575.4A reflected cross-site scripting (xss) vulnerability exists in the encapsulatedDoc functionality of MedDream PACS Premium 7.3.6.870. A speciCVE-2025-541587.8Missing authentication for critical function vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.2-13960 allows local userCVE-2025-541597.5Missing authorization vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.2-13960 allows remote attackers to delete arbitrCVE-2025-54162.7A vulnerability has been identified in Keycloak that could lead to unauthorized information disclosure. While it requires an already authentCVE-2025-541607.8Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in BeeDrive in Synology BeeDrive for desktop beCVE-2025-541614.9An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gainsCVE-2025-541624.9A path traversal vulnerability has been reported to affect File Station 5. If a remote attacker gains an administrator account, they can theCVE-2025-541634.9A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains an administrator account, thCVE-2025-541644.9An out-of-bounds read vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an adminiCVE-2025-541654.9An out-of-bounds read vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an admini