QNAP TS-453E Format String Bug Allows Unauthenticated Remote Code Execution via Syslog

Zero Day Initiative disclosed a format string vulnerability in QNAP TS-453E network-attached storage devices. The flaw permits unauthenticated attackers to execute arbitrary code on affected installations.

What happened

Zero Day Initiative published advisory ZDI-26-776 regarding a vulnerability in QNAP TS-453E hardware. The specific issue resides within the handling of the log_message parameter provided to the syslog service. Attackers can exploit this flaw because the system fails to validate user-supplied strings before using them as format specifiers.

This lack of validation allows network-adjacent attackers to execute code in the context of the TFTP server. Authentication is not required to exploit the vulnerability. The advisory assigns CVE-2018-10388 and CVE-2018-10389 to the issue. Zero Day Initiative rates the vulnerability with a CVSS score of 7.5, classifying it as high severity.

Why it matters

Organisations running QNAP TS-453E devices are exposed to remote code execution risks. The unauthenticated nature of the flaw means attackers do not need valid credentials to compromise the system. This aligns with previous reporting on remote execution risks, as Packet Tribune reported on 2026-10-14 regarding Microsoft RPC Runtime Library flaws.

The vulnerability was reported to the vendor on 2025-12-04. The coordinated public release occurred on 2026-10-15. Environments that have not applied the latest firmware updates remain vulnerable to this specific attack vector.

Next steps

• Verify current firmware versions against the fixed build numbers provided by the vendor.
• Prioritise patching for devices accessible from untrusted networks.
• Review syslog configurations to restrict input sources where possible.
• Monitor network traffic for unusual TFTP server activity.

Detection notes

Security teams should monitor syslog servers for malformed or unusually long message payloads. Look for crashes or unexpected restarts of the syslog service following network spikes. Check for outbound connections from the TFTP service port to external IP addresses. Inspect process lists for new or unrecognised executables running under the TFTP user context. Review firewall logs for inbound traffic targeting syslog ports from unexpected sources. Isolate affected devices from the network immediately upon detection of anomalous behaviour.

What to do and how to stay safe: QNAP

• Apply the latest firmware updates for QTS and QuTS hero operating systems.
• Restrict network access to syslog ports to trusted management interfaces only.
• Implement network segmentation to limit lateral movement from compromised storage devices.
• Enable enhanced logging on all network-attached storage appliances for forensic analysis.

Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Production

General security guidance from the Packet Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which CVE IDs are associated with this QNAP vulnerability?

The advisory assigns CVE-2018-10388 and CVE-2018-10389 to this format string flaw.

Is authentication required to exploit this vulnerability?

No, authentication is not required to exploit this vulnerability on affected devices.

What is the CVSS score for ZDI-26-776?

Zero Day Initiative has assigned a CVSS rating of 7.5 to this vulnerability.