CVE-2025-62849 is a critical (CVSS 9.8) SQL injection (CWE-89) affecting several QNAP operating system versions. QNAP lists fixes in QTS 5.2.7.3297 build 20251024, QuTS hero h5.2.7.3297 build 20251024 and QuTS hero h5.3.1.3292 build 20251024, and later. Update your NAS.
What's affected
The record is based on QNAP advisory QSA-25-45. It says "several" operating system versions are affected and lists these fixed versions:
- QTS 5.2.7.3297 build 20251024 and later
- QuTS hero h5.2.7.3297 build 20251024 and later
- QuTS hero h5.3.1.3292 build 20251024 and later
The record does not list the affected ranges. I could not load the QNAP advisory page when preparing this post, so confirm the exact affected builds there. As a working rule, any QTS or QuTS hero firmware older than the builds above, on the matching branch, should be treated as affected.
The CVSS vector is network reachable, low complexity, no privileges and no user interaction, with high impact on confidentiality, integrity and availability. The record says an attacker can use the flaw to execute unauthorized code or commands. It does not mark the CVE as CISA Known Exploited.
How to check if you're exposed
On the NAS, open the control panel and read the firmware version under the system or firmware update section. Compare it with the fixed builds above for QTS or QuTS hero, using the one that matches your edition and branch.
Then check how the NAS is reachable:
- Is the management interface or any web service published to the internet through port forwarding or UPnP?
- Is the device reachable through QNAP cloud or relay features that you did not intentionally enable?
- Which networks and VPN users can reach its web ports?
For a fleet, QNAP management tools and your network scanner can list model and firmware version, so you can build a list of units below the fixed builds.
What to do now
- Update to the fixed build for your edition, QTS 5.2.7.3297 build 20251024 or later, or the matching QuTS hero build, using the firmware update page.
- Take the NAS off direct internet exposure. Disable port forwarding and UPnP for its web ports, and use a VPN for remote access.
- Read advisory QSA-25-45 for the full affected list and any extra steps for your model.
- Check admin accounts, scheduled tasks and installed apps for changes you do not recognise.
- Make sure you have offline or immutable backups, because storage devices are a favourite target for ransomware.
Why it matters
SQL injection happens when user input is placed into a database query as code. (CWE-89) The database cannot tell the difference between the query you wrote and text an attacker added, so the attacker can read or change data and, on some systems, run commands. The fix is parameterised queries, where input is always passed as data.
A flaw like this on a NAS is serious because these devices hold backups and shared files, and they are often reachable from the internet. A network reachable bug that needs no login gets the top score for that reason.
I found no claim of exploitation in the record, and the CVE is not marked CISA Known Exploited. Treat it as an urgent update all the same.
Try it yourself
Watching for new advisories on the devices you own is half the job. This demo shows a watch workflow.
Click through it at your own pace, or open it full screen.
Quick check
Which build do I need?
QTS 5.2.7.3297 build 20251024 or later, QuTS hero h5.2.7.3297 build 20251024 or later, or QuTS hero h5.3.1.3292 build 20251024 or later, depending on your edition and branch.
Can I just block access instead of updating?
Removing internet exposure lowers the risk but does not remove the flaw. Update, and keep the device off the public internet as well.
Sources
Last reviewed: 18 October 2026.
