QNAP TS-453E syslog log_message Format String Remote Code Execution Vulnerability

October 15th, 2026
ZDI-26-776 ZDI-CAN-28486

CVE ID

CVE-2018-10388, CVE-2018-10389

CVSS Score

7.5 AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Vendors

QNAP

Affected Products

TS-453E

Vulnerability Details

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of QNAP TS-453E devices. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of the log_message parameter provided to syslog. The issue results from the lack of proper validation of a user-supplied string before using it as a format specifier. An attacker can leverage this vulnerability to execute code in the context of the TFTP server.

Additional Details

Fixed in:
QTS 5.2.8.3350 build 20251216
QuTS hero h5.2.8.3350 build 20251216
QuTS hero h5.3.2.3354 build 20251225
QuTS hero h6.0.0.3397 build 20260206


Disclosure Timeline

  • 2025-12-04 - Vulnerability reported to vendor
  • 2026-10-15 - Coordinated public release of advisory
  • 2026-10-15 - Advisory Updated

Credit

gcali (@_gcali)

Back to Advisories