License Center CVE-2025-62851

Exploitation requires the attacker to first obtain a local administrator account on the QNAP NAS device running License Center - confirmed by the CVSS PR:H (high privileges required) and the vendor description. Without administrative credentials, the vulnerability cannot be triggered. The CVSS AV:N indicates the attack is delivered over the network once credentials are available; however, the vendor description uses 'local attacker,' which may imply LAN-based access rather than arbitrary internet exposure - this should be verified against the full advisory. Exploitation is limited to confidentiality impact only (file read); no write, modification, or availability impact is possible per VC:H/VI:N/VA:N. Non-default or special configuration is not required beyond the attacker having an admin account.

The CVSS 4.0 base score of 6.9 reflects the high-privilege requirement (PR:H) as the primary limiting factor - an attacker must already control an administrator account before exploitation is possible, substantially narrowing the attack surface. The AV:N vector indicates the vulnerable interface is accessible over the network, but the description refers to a 'local attacker' obtaining an admin account, which introduces a mild tension worth verifying with the vendor: it is unclear whether 'local' refers to physical/LAN proximity or simply a threat actor already present in the environment. No EPSS score was provided in the input, and the vulnerability does not appear in the CISA KEV catalog, meaning no confirmed active exploitation exists at this time. No public proof-of-concept code has been identified. Given PR:H and the read-only impact (VC:H, VI:N, VA:N), real-world risk is meaningful primarily in scenarios where attackers have already achieved admin-level access and seek to escalate situational awareness - for example, exfiltrating credentials or configuration secrets from system files. Organizations with strict admin account hygiene and MFA on QNAP management interfaces can treat this as a lower-urgency but still addressable patch.

An attacker who has obtained QNAP NAS administrator credentials - through credential stuffing, phishing, or reuse from another compromised service - authenticates to License Center over the network and submits a crafted request containing path traversal sequences in a file-path parameter. The application fails to sanitize the input and resolves the traversed path, returning the contents of a sensitive system file such as a password store or configuration file outside the License Center directory. No public proof-of-concept has been identified, but the attack pattern for CWE-22 is well understood and low-complexity once administrative access is established.