CVE-2025-59385 is a critical (CVSS 9.8) authentication bypass by spoofing in QNAP QTS and QuTS hero. QNAP lists fixes in QTS 5.2.7.3297 and QuTS hero h5.2.7.3297 and h5.3.1.3292, all build 20251024 or later. Update, and check advisory QSA-25-45. The sections below cover who is affected, how to check, and what to do now.
What's affected
From the record, which quotes QNAP, the issue affects several QNAP operating system versions, and QNAP has fixed it in:
- QTS 5.2.7.3297 build 20251024 and later
- QuTS hero h5.2.7.3297 build 20251024 and later
- QuTS hero h5.3.1.3292 build 20251024 and later
The record does not list every affected branch. The QNAP advisory QSA-25-45 should be checked for the full list, especially if you run an older QTS or QuTS hero line.
How to check if you're exposed
On the NAS, open the Control Panel, go to System, then Firmware Update, and read the installed version and build. Compare it with the fixed builds above.
Also check whether the device is reachable from the internet. Storage appliances are often exposed by port forwarding or through cloud access features, and a network reachable authentication bypass is most dangerous when the admin interface faces the internet.
What to do now
- List every QNAP device you run and its firmware build.
- Update to a fixed build from the advisory for your product line.
- Take the admin interface off the public internet, and use a VPN for remote access.
- Review accounts, shared folders and scheduled tasks for anything you did not create.
- Make sure you have an offline or immutable backup that the NAS itself cannot erase.
Why it matters
The record maps this to CWE-290, authentication bypass by spoofing. The description says remote attackers can access resources that are not otherwise accessible without proper authentication. The vector shows network access, low complexity, no privileges, no user interaction and high impact on all three properties.
Network attached storage holds backups and shared files, which makes it a favourite target in general. This CVE is not on the CISA KEV list, and the record says nothing about exploitation. Even so, the combination of internet reachable devices and a pre authentication bypass is a reason to patch within days, not weeks.
Missing authentication is the simplest class of access flaw to describe and one of the easiest to prevent. A function that changes data or reveals data must check who is asking, every time, on the server. Hiding the URL, or relying on the front end to show a login screen first, does not count as a check.
A useful habit is to list every route, endpoint and file an application exposes and mark which ones enforce a login. Anything unmarked is a finding until proven otherwise. Network controls such as an allow list or a VPN reduce who can reach the service, but they are a layer on top of authentication, not a substitute for it.
A dependency scan will not see this one, because it concerns a product or service rather than a package in your code. The practical step is an asset inventory that records which of these products you run, which version, and who owns it. You can look up the record for this CVE in the Safeguard Gold directory and use the free scan at gold.safeguard.sh/scan for the software you build yourself.
Quick check
Which QNAP builds fix CVE-2025-59385?
QTS 5.2.7.3297, QuTS hero h5.2.7.3297 and QuTS hero h5.3.1.3292, each at build 20251024 or later.
My QTS is on a different version. What now?
Read advisory QSA-25-45. The record lists only these three fixed lines, so confirm your branch there.
Sources
- QNAP advisory QSA-25-45 (listed in the record)
- NVD record data
Last reviewed: 18 October 2026.
