Qsync Central CVE-2025-54153

Exploitation requires the attacker to first possess a valid, even if low-privileged, user account on the targeted Qsync Central installation (CVSS PR:L) - this is the primary limiting factor and rules out anonymous mass exploitation. No user interaction is required (UI:N) and the attack is over the network (AV:N) against the application's standard authenticated interface, so once credentials are held, no special non-default configuration is indicated in the vendor description. Affected deployments are Qsync Central 5.0.0 up to (but not including) 5.0.0.2; upgrading to 5.0.0.2 or later removes the condition. The impact is bounded to confidentiality and integrity of the backend database (VA:N - no availability/denial-of-service effect).

Multiple signals converge on this being a genuine but second-tier priority rather than an emergency. The QNAP-assigned CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) scoring 8.6 indicates remote, low-complexity exploitation requiring only a low-privileged authenticated user account, with high confidentiality and integrity impact (VC:H/VI:H) but no availability impact (VA:N) and no scope change to subsequent systems. The PR:L requirement is the single most important mitigating factor: an attacker must first obtain a valid user account, which contradicts a mass-exploitation profile. This is corroborated by the EPSS score of just 0.09% (26th percentile), signalling very low predicted exploitation probability. There is no CISA KEV listing and no public proof-of-concept referenced in the provided data, so exploitation is not confirmed in the wild. The signals are internally consistent - there is no CVSS-versus-description conflict - but note the description's phrasing 'execute unauthorized code or commands' slightly overstates a CWE-89 SQL injection, which the vector more accurately scopes to data confidentiality/integrity (VA:N, no availability loss), so treat claims of full code execution with caution pending vendor clarification. Overall: a legitimately high-severity authenticated SQLi worth patching on a normal cycle, not a drop-everything zero-day.

An attacker who has obtained or been granted a low-privileged account on a QNAP NAS running Qsync Central sends crafted input to a vulnerable parameter, injecting SQL that is executed by the backend database. This lets them read or tamper with data beyond their authorization level and, per the vendor, potentially influence command execution. No public exploit code is identified at time of analysis, and exploitation is gated by first needing valid credentials.