Qsync Central CVE-2025-33039

Requires a valid Qsync Central user account (CVSS PR:L) with network reach to the Qsync Central service on a QNAP NAS; exploitation is remote and needs no user interaction (UI:N) once authenticated. The limiting factors that reduce real-world risk are: (1) the attacker must already possess or acquire credentials for a user account, so purely unauthenticated attackers cannot trigger it; (2) the impact is confined to availability (resource exhaustion / denial of service) with no data disclosure or modification; and (3) devices are only at risk if running an affected version prior to Qsync Central 5.0.0.1 and exposing the service to the attacker. No special non-default feature toggle is named in the advisory beyond having Qsync Central deployed.

This is a moderate, availability-only issue rather than a top-tier emergency. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H, score 7.1) shows a network-reachable, low-complexity attack that requires an authenticated user account (PR:L) and yields no confidentiality or integrity impact - only high availability impact (resource exhaustion, consistent with CWE-770). All signals point the same direction and do not conflict: EPSS is low at 0.15% (36th percentile), the CVE is not on CISA KEV, and no public exploit was identified, so there is no public exploit identified at time of analysis. The combination of a required authenticated account plus a DoS-only outcome means this is a real but contained risk - a priority for internet-exposed, multi-user QNAP deployments where low-privileged accounts are common, but not a widespread-exploitation scenario. The main caveat is that the exact resource being exhausted and whether one user can deny service to others versus crashing the whole service is not specified in the description; treat the DoS blast radius as the key unknown to verify with QNAP advisory QSA-25-34.

An attacker who already holds (or obtains) a low-privileged user account on a QNAP device running Qsync Central sends repeated requests over the network that cause Qsync Central to allocate a particular resource without limit. This exhausts that resource and prevents other legitimate users, systems, or processes from using the same Qsync Central functionality. No public exploit code is known, and the attack requires valid authentication (PR:L) over a network-reachable interface.