Qsync Central CVE-2025-44012

Exploitation requires the attacker to first hold a valid Qsync Central user account (per the description, 'if a remote attacker gains a user account'), consistent with PR:L - this is the primary limiting factor: it is NOT unauthenticated. Once authenticated, no additional user interaction (UI:N) or special non-default configuration is called out. Affected deployments are Qsync Central 5.0.0 up to but not including 5.0.0.2; upgrading to 5.0.0.2 (released 2025/07/31) or later removes the flaw. The description does not name the exact resource or feature that lacks throttling, so defenders should treat any authenticated-user-reachable Qsync Central endpoint as potentially in scope; practical risk is highest where low-privilege accounts are easy to obtain or where the NAS is internet-exposed.

This is a moderate, not urgent, priority. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity attack that requires an authenticated low-privileged user account (PR:L) and yields availability-only impact (VC:N/VI:N/VA:H), consistent with the CWE-770 resource-exhaustion denial-of-service class. These signals align with the description, which explicitly states the attacker must first 'gain a user account' before preventing others from accessing a resource. The real-world urgency signals are low and mutually consistent: EPSS is only 0.15% (36th percentile), the CVE is not listed in CISA KEV, and no public exploit code was identified - so there is no evidence of active or imminent mass exploitation. The impact ceiling is bounded to availability; there is no confidentiality or integrity loss, so this cannot be chained into data theft or code execution on its own. Net assessment: a legitimately rated 7.1 DoS flaw whose practical risk is tempered by the authentication prerequisite and the absence of exploitation evidence - patch in normal cycles, prioritizing internet-exposed instances where low-privilege accounts are easily obtained.

An attacker who has obtained a valid low-privileged Qsync Central user account (for example via phishing, credential stuffing, or a self-registered/guest account on an exposed NAS) sends repeated or crafted requests that cause unbounded resource allocation. This exhausts the shared resource and denies service to other legitimate users, applications, or processes. No public proof-of-concept exploit was identified at time of analysis.