Loading vulnerability…
CVE-2025-59382 is a URL injection vulnerability in QNAP software that affects QVP. According to the provided content, a remote attacker can modify the password reset URL and trick a victim into visiting an attacker-controlled password reset page. This indicates the password reset workflow does not sufficiently validate or constrain the reset URL presented to the user, enabling redirection or substitution of the legitimate reset destination with an attacker-controlled page. The primary consequence described is credential theft via a spoofed password reset experience. The provided content also states that QTS, QuTS hero, and QuTScloud are not affected.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository contains a small, focused exploit PoC for CVE-2025-59382 affecting QNAP password reset handling. The repo has three files: a README describing the vulnerability and attack chain, a PowerShell exploit script (exploit_chain.ps1), and an evidence text file containing a captured HTML reset email proving attacker-controlled URL injection. The exploit is not part of a larger framework. The main code is the PowerShell script, which implements an end-to-end account takeover chain against a vulnerable QNAP NAS. It first triggers /cgi-bin/reset_password.cgi with func=send_mail, user=admin, and an attacker-supplied url parameter. The vulnerability is that the backend trusts this url and embeds it directly into the official QNAP password reset email, appending the username and reset token (rp). In a real attack, the victim clicks the phishing link and the attacker receives the rp token; the victim can then be prompted to enter the verification code shown in the same email. In the provided lab PoC, the script shortcuts victim interaction by using SSH access to the NAS to clear prior reset state and read a locally captured outbound email from /tmp/captured_email.txt. It extracts the verification code and rp token with regex, then sends a POST request to /cgi-bin/reset_password.cgi using func=reset_user_pw, token=<rp>, vc=<code>, and a base64-encoded attacker-chosen password. Finally, it verifies success by authenticating to /cgi-bin/authLogin.cgi as admin with the new password. Primary exploit capabilities: unauthenticated triggering of password reset emails, phishing URL injection into trusted vendor-branded email, extraction/use of reset token and verification code, password reset of the target account, and confirmation of full admin account takeover. The script is operational but lab-oriented because it contains hardcoded target values and relies on SSH/local email capture for demonstration.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A URL injection vulnerability in QNAP NAS products that allows a remote attacker to alter the password reset URL and lure victims to an attacker-controlled reset page, enabling credential theft.
A URL injection vulnerability in QNAP systems that allows a remote attacker without admin rights to alter a password reset link and steal credentials.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.