Qsync Central CVE-2025-29895

Exploitation requires the attacker to first obtain a valid Qsync Central / NAS user account (PR:L, confirmed by both the description 'if a remote attacker gains a user account' and the CVSS vector), so this is not exploitable by fully unauthenticated attackers. The CVSS 4.0 vector also specifies AT:P (attack requirement present), indicating success depends on a specific condition or state not under the attacker's full control that is not enumerated in the vendor description. Impact is limited to availability of the Qsync Central service (VA:L) with no confidentiality or integrity effect; the crash is a recoverable DoS affecting only Qsync Central, not the entire NAS. The authentication requirement and availability-only, recoverable impact are the principal factors limiting real-world risk.

This is a genuinely low-priority issue despite being tracked as a CVE. The vendor-supplied CVSS 4.0 base score is 0.6 (Low), consistent with the metrics: network attack vector (AV:N) but requiring an existing user account (PR:L), a present attack requirement (AT:P) indicating some non-guaranteed precondition, and impact limited to availability of the vulnerable system only (VA:L, with VC:N/VI:N - no confidentiality or integrity loss). The CWE-476 NULL pointer dereference maps to a crash/DoS of the Qsync Central service rather than code execution or data exposure. No EPSS score was provided in the input, and there is no CISA KEV listing and no public proof-of-concept, so there is no public exploit identified at the time of analysis. All signals align downward: authenticated-only, availability-only, no exploitation evidence. The only mild amplifier is the network vector, but the PR:L authentication requirement and trivial impact (a recoverable service DoS) make this a low real-world risk that does not warrant emergency patching - schedule it in routine maintenance.

An attacker who already possesses valid credentials for a user account on a QNAP NAS running Qsync Central sends a crafted request over the network that triggers a NULL pointer dereference in the Qsync Central service, crashing it and denying file-sync service to legitimate users. No public exploit code has been identified, and the attacker gains no data access or code execution - only a temporary disruption of availability.