QNAP QTS: CVE-2025-62849: Multiple Vulnerabilities in QTS and QuTS hero (PWN2OWN 2025)

Multiple vulnerabilities have been reported to affect certain QNAP operating system versions. We have already fixed the vulnerabilities in the following versions: CVE-2025-62847: Improper neutralization of argument delimiters in a command vulnerability If exploited, remote attackers can alter execution logic. CVE-2025-62848: NULL pointer dereference vulnerability If exploited, remote attackers can launch a denial-of-service (DoS) attack. CVE-2025-62849: SQL injection vulnerability If exploited, remote attackers can execute unauthorized code or commands. CVE-2025-59385: Authentication bypass by spoofing vulnerability If exploited, remote attackers can access resources which are not otherwise accessible without proper authentication.