CVE-2025-62847

HighCVSS 7.5/10Last modified Oct 7, 2026

Description

An improper neutralization of argument delimiters in a command vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to alter execution logic.

We have already fixed the vulnerability in the following versions: QTS 5.2.7.3297 build 20251024 and later QuTS hero h5.2.7.3297 build 20251024 and later QuTS hero h5.3.1.3292 build 20251024 and later

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-88

Affected software

No affected versions have been published.

Timeline

Published
Dec 16, 2025
Last modified
Oct 7, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-628487.5A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then eCVE-2025-628499.8An SQL injection vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit theCVE-2025-62856.1A vulnerability was found in PHPGurukul COVID19 Testing Management System 2021. It has been rated as problematic. This issue affects some unCVE-2025-628507.2A NULL pointer dereference vulnerability has been reported to affect QTS, QVP, QuTS cloud and QuTS hero. If a remote attacker gains an adminCVE-2025-628514.4A path traversal vulnerability has been reported to affect License Center. If a local attacker gains an administrator account, they can thenCVE-2025-628526.5A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administraCVE-2025-628536.5A path traversal vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit CVE-2025-628546.5An uncontrolled resource consumption vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, thCVE-2025-628554.4A path traversal vulnerability has been reported to affect File Station 5. If a local attacker gains an administrator account, they can thenCVE-2025-628564.4A path traversal vulnerability has been reported to affect File Station 5. If a local attacker gains an administrator account, they can thenCVE-2025-628576.1A cross-site scripting (XSS) vulnerability has been reported to affect QuMagie. The remote attackers can then exploit the vulnerability to bCVE-2025-628586.5A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administra
CVE-2025-62847: High severity, CVSS 7.5 | Vulnix