Qnap QTS and QuTS hero NULL Pointer Dereference (CVE-2025-66281)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(505902);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/31");

  script_cve_id("CVE-2025-66281");

  script_name(english:"Qnap QTS and QuTS hero NULL Pointer Dereference (CVE-2025-66281)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"A NULL pointer dereference vulnerability has been reported to affect
several QNAP operating system versions. The remote attackers can then
exploit the vulnerability to launch a denial-of-service (DoS) attack.
We have already fixed the vulnerability in the following versions: QTS
5.2.9.3410 build 20260214 and later QuTS hero h5.2.9.3410 build
20260214 and later QuTS hero h5.3.4.3500 build 20260520 and later QuTS
hero h6.0.0.3397 build 20260206 and later

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_attribute(attribute:"see_also", value:"https://www.qnap.com/en/security-advisory/qsa-26-10");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-66281");
  script_cwe_id(476);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/06/10");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/06/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/31");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:qts");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:quts_hero:h5");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:quts_hero:h6");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Qnap");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Qnap');

var asset = tenable_ot::assets::get(vendor:'Qnap');

var vuln_cpes = {
    "cpe:/o:qnap:qts" :
        {"versionEndExcluding" : "5.2.9.3410", "versionStartIncluding" : "5.2.0.2737", "family" : "QTS"},
    "cpe:/o:qnap:quts_hero:h5:u01" :
        {"versionEndExcluding" : "h5.2.9.3410", "versionStartIncluding" : "h5.2.0.2737", "family" : "QuTShero"},
    "cpe:/o:qnap:quts_hero:h5:u02" :
        {"versionEndExcluding" : "h5.3.4.3500", "versionStartIncluding" : "h5.3.0.3115", "family" : "QuTShero"},
    "cpe:/o:qnap:quts_hero:h6" :
        {"versionEndExcluding" : "h6.0.0.3397", "versionStartIncluding" : "h6.0.0.3324", "family" : "QuTShero"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);