Qsync Central CVE-2025-44007

Exploitation requires the attacker to first obtain a valid Qsync Central user account (CVSS PR:L) - the description explicitly states 'If a remote attacker gains a user account.' Once authenticated, the attacker abuses an operation that allocates resources without limits or throttling (CWE-770) to exhaust a shared resource and deny it to other systems, applications, or processes. The limiting factors are the authentication requirement (no anonymous/unauthenticated path) and the impact being confined to availability - no data disclosure or modification occurs. Affected deployments are Qsync Central 4.x prior to 5.0.0.1; upgrading to 5.0.0.1 or later removes the condition.

This is a moderate-severity availability-only vulnerability (CWE-770, resource allocation without throttling) whose signals are internally consistent and point to limited real-world urgency. The vendor-assigned CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H) confirms a network-reachable, low-complexity attack that nonetheless requires an authenticated user account (PR:L) and yields only a high availability impact with no confidentiality or integrity loss - a classic denial-of-service profile rather than a system-takeover flaw. EPSS is low at 0.15% (36th percentile), the CVE is NOT listed in CISA KEV, and no public exploit code was identified in the provided data; all three low-threat signals agree with each other and with the DoS-only impact. There is no SSVC decision data in the input to incorporate. The authentication requirement (PR:L) is the key mitigating factor: an attacker needs valid credentials on Qsync Central before they can exhaust resources, which limits exposure to insiders or attackers who have already obtained an account. No signals conflict, but note the impact is availability-only - this is a genuine but lower-priority issue, appropriate for routine patching rather than emergency response, especially where the management interface is not exposed to untrusted users.

An attacker who has obtained or been granted a low-privileged Qsync Central user account sends repeated or crafted requests that trigger unbounded resource allocation, exhausting memory, connections, or processing capacity. This denies other users, applications, or processes access to the same resource, degrading or halting Qsync synchronization services. No public proof-of-concept exploit was identified at time of analysis.