Critical QNAP .NET Flaw Lets Attackers Bypass Security Protections

A significant security vulnerability has emerged affecting QNAP’s NetBak PC Agent software through a critical flaw in Microsoft ASP.NET Core.

The vulnerability, tracked as CVE-2025-55315, exploits HTTP Request Smuggling techniques to bypass essential security controls and could expose thousands of backup-dependent systems to unauthorized access and data manipulation.

The flaw resides in ASP.NET Core’s HTTP request handling mechanisms, allowing authenticated attackers to craft specially designed requests that confuse the web server’s security processing.

Once exploited, attackers gain the ability to access sensitive data stored on affected systems, modify critical server files, or trigger limited denial-of-service conditions that disrupt backup operations.

For organizations relying on NetBak PC Agent for data protection, this represents a direct threat to backup integrity and system security.

Overview of ...