Format String RCE (CVE‑2025‑62848) in QNAP TS‑453E Exposes Enterprise NAS Devices

Format String RCE (CVE‑2025‑62848) in QNAP TS‑453E NAS Devices

What It Is — A format‑string flaw in the conn_log_tool utility of QNAP’s TS‑453E network‑attached storage (NAS) permits an attacker to execute arbitrary code with administrative privileges. The vulnerability (CVE‑2025‑62848) scores 5.5 (CVSS 3.1) and requires network‑adjacent access; authentication can be bypassed via crafted input.

Exploitability — No public exploits have been observed, but a proof‑of‑concept exists and the vulnerability is actively exploitable by skilled adversaries.

Affected Products — QNAP TS‑453E (all firmware versions prior to the March 2026 security update).

TPRM Impact — QNAP NAS units are widely deployed as third‑party storage, backup, and file‑sharing solutions. Compromise can lead to data theft, ransomware deployment, or lateral movement into the broader enterprise network, representing a supply‑chain risk for any organization that outsources storage to QNAP.

Recommended Actions

• Verify inventory of QNAP devices and confirm model TS‑453E presence.
• Apply QNAP’s March 2026 firmware patch (see QSA‑25‑45).
• Segment NAS devices on isolated VLANs; restrict inbound traffic to required management ports only.
• Enforce strong, unique admin credentials and enable MFA where supported.
• Deploy IDS/IPS signatures for the conn_log_tool exploit pattern and monitor logs for anomalous format‑string activity.
• Consider temporary de‑activation of conn_log_tool if not required for operations.

Source: Zero Day Initiative Advisory ZDI‑26‑199