Remote Code Execution in QNAP TS-453E NAS (CVE-2025-62842) Demonstrated in Pwn2Own
What It Is – A path‑validation flaw in the write_file_to_svr routine of QNAP’s TS‑453E network‑attached storage (NAS) allows an attacker to execute arbitrary code with RR2 administrator privileges. The vulnerability is tracked as CVE‑2025‑62842 and carries a CVSS 6.8 (AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
Exploitability – The issue was publicly demonstrated at the Pwn2Own competition, confirming a working exploit that bypasses authentication. A proof‑of‑concept is available, and an official QNAP firmware update has been released.
Affected Products – QNAP TS‑453E (all firmware versions prior to the March 2026 security update).
TPRM Impact – Organizations that rely on QNAP NAS devices for file sharing, backup, or application hosting face a realistic risk of ransomware deployment, data exfiltration, or service interruption through a compromised storage tier. Because NAS appliances often sit on internal networks and connect to cloud gateways, a breach can cascade to downstream suppliers and customers.
Recommended Actions –
- Deploy QNAP’s security advisory QSA‑25‑46 patch immediately on all TS‑453E units.
- Verify firmware version via the QNAP admin console; enforce automatic update policies.
- Segment NAS devices on a dedicated VLAN and restrict inbound traffic to required management ports only.
- Enable multi‑factor authentication for the RR2 admin account and audit login logs for anomalous activity.
- Conduct an inventory of all QNAP devices across the supply chain and assess exposure in third‑party contracts.