CVE-2025-52856 is a critical improper authentication flaw (CVSS 9.8) in QNAP VioStor, the network video recorder software. QNAP says it has fixed the problem in VioStor 5.1.6 build 20250621 and later. Update the firmware to that build or newer, and keep the recorder off the public internet.
What's affected
The record is short. It says an improper authentication vulnerability was reported in VioStor, and that a remote attacker could use it to compromise the security of the system. QNAP states the fix is in VioStor 5.1.6 build 20250621 and later.
The NVD record classifies the weakness as CWE-287, improper authentication, with a network attack vector, low complexity, and no privileges or user interaction needed. The record does not list which earlier builds are affected, and it does not describe the mechanism. Read the QNAP advisory QSA-25-29 for the exact affected builds and for any model specific notes, because I could not load that page while preparing this article.
How to check if you're exposed
Log in to the VioStor management page and read the firmware or software version, then compare it with 5.1.6 build 20250621. Anything older than that build should be treated as affected until the advisory says otherwise.
Also check how the recorder is reached. Look at your router or firewall for port forwards that point at the device, and at any cloud relay or remote access feature that is switched on. A recorder reachable from the internet is a far bigger risk than one that only answers on a camera VLAN.
Your asset inventory should list every QNAP video recorder, including units installed years ago by a facilities team or an integrator.
What to do now
- Identify every QNAP VioStor unit and note its current version and build.
- Update to VioStor 5.1.6 build 20250621 or later, following the steps in QNAP advisory QSA-25-29.
- Remove any port forward or direct internet exposure of the management interface, and use a VPN for remote access.
- Change administrator passwords and review the user list for accounts you do not recognise.
- Review access logs on the device for logins you cannot explain, and keep a copy before you update.
Why it matters
Improper authentication means the product can be convinced that a caller is allowed in without proving who they are. On a video recorder that is serious, because the device holds recorded footage, credentials for cameras, and often a position inside a trusted network segment.
Network video recorders are a common foothold because they are installed once and rarely patched. The record gives no sign that this CVE is used in attacks, and it is not on the CISA Known Exploited Vulnerabilities list. A critical score with no login needed is still reason enough to update soon and to cut off internet access to the management interface.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Where do I find the exact fixed build?
QNAP states VioStor 5.1.6 build 20250621 and later in its advisory QSA-25-29. Check that page for model notes before you update.
Sources
Last reviewed: 18 October 2026.
