Skip to content

QNAP NAS Zero-Day Vulnerabilities Demonstrated at Pwn2Own Ireland 2025

alt text

QNAP NAS Zero-Day Pwn2Own Ireland 2025 RCE + Privilege Escalation

Overview

QNAP Systems released patches for multiple critical vulnerabilities affecting NAS operating systems and applications. These flaws were discovered and successfully exploited during Pwn2Own Ireland 2025, demonstrating pathways for unauthorized access, code execution, and full device compromise.

The demonstrations highlight the risk of chained exploitation against internet-exposed NAS environments where storage, backup, and management services are directly reachable.

Technical Specifications

Attribute Details
CVE IDs Multiple CVEs reported, including CVE-2025-62846
CVSS Score 9.3(Critical)
Affected Components QTS, QuTS hero, Hybrid Backup Sync (HBS 3), Hyper Data Protector, Malware Remover
Vulnerability Classes Code injection, improper input validation, memory corruption/format string issues
Exploit Pattern Chaining of multiple vulnerabilities to bypass protections
Exploit Outcome Remote code execution followed by privilege escalation to root
Validation Context Publicly demonstrated by security teams in live contest conditions
Primary Exposure Risk Internet-accessible NAS web/app services

Affected Products

  • QNAP NAS devices running vulnerable QTS and QuTS hero versions
  • Deployments using vulnerable plugin/application versions: HBS 3, Hyper Data Protector, Malware Remover
  • Organizations exposing NAS management interfaces directly to the internet
  • Environments using NAS as a central backup and file repository

Attack Scenario

  1. Target Discovery: Attacker identifies an internet-exposed QNAP NAS device.

  2. Initial Exploitation: A vulnerable web service or application component is exploited.

  3. Vulnerability Chaining: Multiple flaws are chained to bypass mitigations and deepen access.

  4. Code Execution: Remote code execution is achieved on the NAS platform.

  5. Privilege Escalation: Attacker elevates to root-level control.

  6. Post-Exploitation Actions: Adversary performs data exfiltration, ransomware deployment, and/or network pivoting.

Impact Assessment

  • Full compromise of NAS configuration and security controls
  • Unauthorized modification or deletion of stored files and backup sets
  • Platform abuse as a trusted internal foothold for follow-on attacks
  • Unauthorized access to sensitive files, archives, and backup data
  • Theft of business-critical or regulated information
  • Increased lateral intelligence collection across connected systems
  • Data encryption or destruction through ransomware operations
  • Disruption of backup/recovery workflows and business continuity
  • Potential wider operational downtime due to lateral movement

Mitigation Strategies

Immediate Actions

  • Apply the latest QNAP updates for QTS and QuTS hero immediately.
  • Update HBS 3, Hyper Data Protector, and Malware Remover to patched versions.
  • Change all credentials after patching and revoke stale sessions/tokens.

Short-term Measures

  • Disable direct internet exposure of NAS management services.
  • Require VPN-based remote access and enforce MFA for administrative logins.
  • Restrict management interface access to trusted IP ranges.

Monitoring & Detection

  • Review NAS and network logs for suspicious login behavior and abnormal process activity.
  • Alert on unusual large outbound transfers and unexpected archive/compression activity.
  • Monitor for signs of privilege escalation, ransomware staging, or unauthorized service changes.

Long-term Solutions

  • Maintain regular patch governance for NAS OS and applications.
  • Segment NAS infrastructure from user endpoints and critical production systems.
  • Validate backup immutability/offline recovery workflows through periodic restore testing.

Resources and References

Open-Source Reporting

Last Updated: March 25, 2026