EUVD-2025-32459Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege user account
-
DeliverySend crafted request to Qsync Central
-
ExploitTrigger out-of-bounds write (CWE-787)
-
ExecutionCorrupt service memory
-
ImpactDenial of service of Qsync Central
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to first possess a valid low-privileged user account on the QNAP device running Qsync Central (PR:L) - this is the primary limiting factor and means the flaw is not usable by a fully unauthenticated attacker. Only Qsync Central versions 4.x below 5.0.0.1 (released 2025-07-09) are affected; devices updated to 5.0.0.1 or later are not. No user interaction is required (UI:N) and no non-default configuration is named in the advisory, but the vulnerable product is an optional add-on app, so only installations that have deployed Qsync Central are exposed. The vendor does not specify the exact protocol or feature that triggers the out-of-bounds write. |
| Impact | This is a moderate-severity, authenticated availability flaw rather than a top-tier emergency. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H) describes a network-reachable, low-complexity attack that requires a valid low-privileged user account and yields only an availability impact (VA:H) - no confidentiality or integrity loss. This aligns with the description: a remote attacker who 'gains a user account' can corrupt memory. Corroborating signals point to low real-world urgency: EPSS is only 0.16% (37th percentile), the CVE is NOT on CISA KEV, and no public proof-of-concept is referenced. The CWE-787 out-of-bounds write could in principle enable more than a crash (memory corruption can sometimes escalate to code execution), but the vendor explicitly scored impact as availability-only with no integrity/confidentiality effect, so the assessed realistic outcome is denial-of-service of the Qsync Central service. Note a mild tension to verify: an out-of-bounds write (CWE-787) often carries integrity/RCE potential, yet the vendor vector sets VC:N/VI:N - if the vendor's impact scoping is conservative, real integrity impact could be higher than advertised; treat VA:H/DoS as the confirmed floor. |
| Exploit ScenarioDerived | An attacker who has obtained or been granted a standard (low-privilege) user account on a QNAP device running Qsync Central sends crafted input to the service over the network, triggering an out-of-bounds write that corrupts process memory and crashes or destabilizes the Qsync Central service (denial of service). No public exploit code has been identified, and exploitation requires valid account credentials first. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 18, 2026
Out-of-bounds write in QNAP Qsync Central 4.x before 5.0.0.1 allows a remote attacker who already holds a valid low-privileged user account to corrupt memory and cause a high availability impact, potentially crashing or disrupting the sync service; confidentiality and integrity impacts are assessed as none. The vendor has released a fix in Qsync Central 5.0.0.1 (2025/07/09), making this a moderate-severity authenticated availability issue rather than an unauthenticated emergency. EPSS is 0.16% (37th percentile), and no public exploit identified at time of analysis.
Earlier versions of this analysis (1)
RemediationAI
Vendor-released patch: Qsync Central 5.0.0.1 (2025/07/09) or later, available through QNAP App Center or the NAS firmware update path; see QSA-25-34 at https://www.qnap.com/en/security-advisory/qsa-25-34. If immediate patching is not possible, remove or disable the Qsync Central app when it is not needed, restrict network access to the Qsync service to trusted users and networks, and enforce least privilege by removing unused low-privileged accounts, since exploitation requires a valid account; these measures reduce exposure but can disrupt remote sync and collaboration workflows. Monitor and audit accounts with access to Qsync Central as a compensating detective control.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Qsync Central is QNAP's optional synchronization add-on for NAS devices. The defect is an out-of-bounds write (CWE-787), a memory-safety class where data is written past the end of an allocated buffer, which can corrupt memory and lead to a crash or denial of service. The affected CPE is cpe:2.3:a:qnap:qsync_central:*:*:*:*:*:*:*:*, with EUVD specifying Qsync Central 4.x below 5.0.0.1; the CVSS vector shows network reachability (AV:N), low privileges required (PR:L), no user interaction (UI:N), and only availability impact (A:H). QNAP's advisory does not name the exact Qsync Central feature or protocol path that triggers the write.
Know when Qsync Central gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Network-reachable service exploitable by any authenticated low-privilege user (PR:L, AV:N, AC:L); vendor scopes impact to availability only, so C:N/I:N/A:H and scope unchanged.
Primary rating from Vendor (qnapsecurity).
CVSS VectorVendor: qnapsecurity
Lifecycle Timeline
5DescriptionCVE.org
An out-of-bounds write vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to modify or corrupt memory.
We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.1 ( 2025/07/09 ) and later
Executive ViewAI
Qsync Central versions prior to 5.0.0.1 contain an out-of-bounds write vulnerability (CVSS 8.8) that allows authenticated remote attackers to corrupt memory and potentially compromise data integrity or system stability. Organizations using Qsync Central must prioritize upgrading to prevent account-based attacks that could lead to unauthorized system manipulation.
Apply vendor patch: Qsync Central 5.0.0.1 (released 2025-07-09) or later. If upgrade cannot be completed within 7 days, restrict Qsync Central user account creation and audit existing account usage to limit exposure window.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
More in Qsync Central
View allAn out-of-bounds write vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user accoun
SQL injection vulnerability in Qsync Central that allows authenticated remote attackers to execute arbitrary code or com
SQL injection in QNAP Qsync Central 5.0.0 (all builds prior to 5.0.0.2) allows a remote attacker who already holds a val
SQL injection in QNAP Qsync Central versions 5.0.0 through below 5.0.0.2 lets a remote attacker who already holds a vali
An improper certificate validation vulnerability has been reported to affect Qsync Central. Rated high severity (CVSS 8.
An improper certificate validation vulnerability has been reported to affect Qsync Central. Rated high severity (CVSS 8.
A buffer overflow vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, th
A buffer overflow vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, th
A buffer overflow vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, th
A buffer overflow vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, th
Format string vulnerability in QNAP Qsync Central that allows authenticated remote attackers to read sensitive data or m
A use of externally-controlled format string vulnerability has been reported to affect Qsync Central. If a remote attack
GitHub PoC
Exploit-DB