Qnap QTS and QuTS hero Stack-based Buffer Overflow (CVE-2025-66280)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(505901);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/31");

  script_cve_id("CVE-2025-66280");

  script_name(english:"Qnap QTS and QuTS hero Stack-based Buffer Overflow (CVE-2025-66280)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"An integer overflow or wraparound vulnerability has been reported to
affect several QNAP operating system versions. If a remote attacker
gains an administrator account, they can then exploit the
vulnerability to compromise the security of the system. We have
already fixed the vulnerability in the following versions: QTS
5.2.9.3410 build 20260214 and later QuTS hero h5.2.9.3410 build
20260214 and later QuTS hero h5.3.4.3500 build 20260520 and later QuTS
hero h6.0.0.3397 build 20260206 and later

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_attribute(attribute:"see_also", value:"https://www.qnap.com/en/security-advisory/qsa-26-10");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-66280");
  script_cwe_id(121, 190);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/06/10");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/06/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/31");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:qts");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:quts_hero:h5");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:quts_hero:h6");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Qnap");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Qnap');

var asset = tenable_ot::assets::get(vendor:'Qnap');

var vuln_cpes = {
    "cpe:/o:qnap:qts" :
        {"versionEndExcluding" : "5.2.9.3410", "versionStartIncluding" : "5.2.0.2737", "family" : "QTS"},
    "cpe:/o:qnap:quts_hero:h5:u01" :
        {"versionEndExcluding" : "h5.2.9.3410", "versionStartIncluding" : "h5.2.0.2737", "family" : "QuTShero"},
    "cpe:/o:qnap:quts_hero:h5:u02" :
        {"versionEndExcluding" : "h5.3.4.3500", "versionStartIncluding" : "h5.3.0.3115", "family" : "QuTShero"},
    "cpe:/o:qnap:quts_hero:h6" :
        {"versionEndExcluding" : "h6.0.0.3397", "versionStartIncluding" : "h6.0.0.3324", "family" : "QuTShero"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);