Qsync Central CVE-2025-44009

Exploitation requires the attacker to first obtain a valid Qsync Central user account (PR:L) - per the description, 'if a remote attacker gains a user account, they can then exploit the vulnerability.' This authentication requirement is the primary limiting factor; the flaw is NOT reachable by fully unauthenticated remote attackers. No user interaction is needed (UI:N) and the attack works over the network against the affected product versions (4.x below 5.0.0.1). Impact is limited strictly to denial of service of the Qsync Central service; there is no confidentiality or integrity exposure. The condition that meaningfully constrains real-world risk is that the attacker must already have authenticated access to the QNAP device's Qsync Central instance.

This is a genuinely low-to-moderate priority issue despite a CVSS 4.0 base score of 5.3 (MEDIUM). The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L) is internally consistent with the description: network-reachable, low complexity, but requiring an authenticated user account (PR:L) and yielding only limited availability impact (VA:L) with zero confidentiality or integrity impact - a textbook NULL pointer dereference DoS (CWE-476). Corroborating signals point the same direction: EPSS is just 0.15% (35th percentile), there is NO CISA KEV listing, and no public exploit code was identified in the provided data. These signals are mutually reinforcing rather than conflicting - low EPSS, no KEV, and authentication-gated low-impact DoS all agree this is not an urgent, widely-exploited threat. The main caveat is that the vendor (QNAP) self-assigned the CVSS and no independent third-party vector is provided, so the PR:L and VA:L claims rest on the vendor advisory alone.

An attacker who already possesses or has obtained valid Qsync Central user credentials sends a specially crafted request over the network that triggers an unchecked NULL pointer dereference in the service. The resulting crash renders the Qsync Central sync service unavailable until it is restarted. No public exploit code was identified at time of analysis, and the attack produces no data exposure or code execution - only denial of service.