Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following versions: QTS 5.2.9.3410 build 20260214 and later QuTS hero h5.2.9.3410 build 20260214 and later QuTS hero h5.3.4.3500 build 20260520 and later QuTS hero h6.0.0.3397 build 20260206 and later
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-06-10 | 1 | Disclosure1 |
| 2026-06-29 | 1 | Patch1 |
| 2026-07-07 | 2 | Disclosure2 |
7/7 QNAP Advisory: https://www.qnap.com/en/security-advisory/qsa-26-10 CVE records: https://www.cve.org/CVERecord?id=CVE-2025-66279 https://www.cve.org/CVERecord?id=CVE-2025-66280 https://www.cve.org/CVERecord?id=CVE-2025-66281
Post summary
The snippet references a QNAP advisory and provides links to the CVE records for CVE‑2025‑66279, CVE‑2025‑66280, and CVE‑2025‑66281, but offers no technical details or exploit information.
2/7 CVE-2025-66279: OS command injection (CVSS 8.6), post-auth Technique: dynamic instrumentation (syscall hooking) An admin-supplied username reaches system() unsanitized, 3 lib calls deep from the user-deletion API. Runtime syscall hooking caught the shell exec.
Post summary
The tweet discloses technical details of CVE-2025-66279, outlining a post-auth OS command injection and a dynamic syscall hooking detection technique, but does not provide a PoC, exploit code, or patch information.
QNAP NAS 製品群の複数の深刻な脆弱性が FIX：認証情報窃取や DoS などの恐れ https://iototsecnews.jp/2026/06/22/qnap-fixes-14-vulnerabilities-in-qts-quts-hero-quts-cloud-and-qvp/ 今回の QNAP のアドバイザリは、URL インジェクションの欠陥 CVE-2025-59382 や、入力サニタイズの不備によるコマンド・インジェクション CVE-2025-66273／CVE-2025-66279 などに対処するものです。また、メモリ処理の不適切な取り扱いから生じるバッファ・オーバーフロー CVE-2026-26241／NULL ポインタ逆参照 CVE-2026-22899／アクセス制御の不備も修正されています。ご利用のチームは、ご注意ください。 #CVE202559382 #CVE202562858 #CVE202566273 #CVE202566279 #CVE202566280 #CVE202566281 #CVE202568405 #CVE202622893 #CVE202622899 #CVE202624720 #CVE202624724 #CVE202626239 #CVE202626240 #CVE202626241 #NAS #QNAP #Vulnerability
Post summary
QNAP’s advisory announces fixes for 14 critical vulnerabilities, detailing the vulnerability types but not presenting proof of exploitation or evidence of active attacks.
CVE-2025-66279 Command Injection Vulnerability in QNAP Operating System Versions https://vulmon.com/vulnerabilitydetails?qid=CVE-2025-66279
Post summary
The text reports a newly disclosed command injection vulnerability (CVE‑2025‑66279) in QNAP Operating System versions, linking to a detail page for further information.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | qnap | qts | - | - | - |
| OS | qnap | quts_hero | - | - | - |