QNAP has released a critical security advisory addressing two distinct vulnerabilities in its License Center application.
If left unpatched, these flaws could enable attackers to steal sensitive information, crash system processes, or modify memory on affected Network Attached Storage (NAS) devices.
The company released a security update on January 3, 2026, to resolve issues in License Center version 2.0.x. Despite being rated as “Moderate” severity, these vulnerabilities pose significant risks if attackers gain initial system access.
Vulnerability Details and Impact
QNAP security advisory QSA-25-52 highlights two memory management vulnerabilities affecting the License Center application.
The first issue, CVE-2025-52871, is an out-of-bounds read vulnerability that allows remote attackers with standard user access to read unauthorized data from system memory.
This could expose sensitive information stored on the device.
The second vulnerability, CVE-2025-53597, is a buffer overflow that requires administrator-level privileges to exploit.
Successful exploitation enables attackers to modify memory or crash processes, potentially causing denial-of-service conditions or system instability.
| CVE Identifier | Vulnerability Type | Severity | Impact |
|---|---|---|---|
| CVE-2025-52871 | Out-of-bounds read | Moderate | Allows authenticated users to obtain secret data |
| CVE-2025-53597 | Buffer overflow | Moderate | Allows administrators to modify memory or crash processes |
QNAP has resolved both issues in License Center version 2.0.36 and later versions.
The company strongly recommends that all users running License Center 2.0.x update to the latest version immediately to protect their systems and data.
To apply the security fix, administrators should log into QTS or QuTS Hero, open the App Center, and search for “License Center.”
When an update is available, users can click the “Update” button to download and install the patched version automatically.
QNAP credited security researcher Coral for discovering and responsibly reporting these vulnerabilities before widespread exploitation could occur.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyber Press as a Preferred Source in Google.
%20(1).webp?fit=1600,900&ssl=1&description=The company released a security update on January 3, 2026, to resolve issues in License Center version 2.0.x. Despite being rated as "Moderate" severity){kind=link}