EUVD-2025-17341Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Format string safety
|
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) indicates moderate-to-high exploitability: network-accessible, low attack complexity, but requires low-level user privilege (authenticated access). The dual impact of confidentiality and integrity breaches (C:H/I:H) without availability impact suggests targeted data exfiltration or memory corruption attacks. Without confirmed KEV status, active exploitation data, or public POC disclosure, this appears to be a responsibly-disclosed vulnerability. The March 2025 patch date suggests QNAP addressed this proactively. Real-world priority depends on: (1) deployment scope (how many users have Qsync Central exposed to untrusted networks), (2) whether internal users can be trusted (PR:L requirement), and (3) whether format string exploitation is reliably weaponizable on this codebase. Organizations with public-facing Qsync Central instances or those with high-risk user bases should treat this as critical; internal-only deployments are lower priority but still require patching within standard patch windows. |
| Exploit ScenarioDerived | An attacker with a valid Qsync Central user account (low privilege) sends a crafted request to a Qsync Central API endpoint or service interface that processes user-supplied input. The attacker includes format string payloads (e.g., '%x.%x.%x.%s' or '%n' directives) in parameters such as filenames, sync rules, notifications, or custom metadata fields. The vulnerable code passes this unsanitized input to a printf-family function, allowing the attacker to: (1) leak sensitive data from the stack or heap (passwords, tokens, encryption keys, process memory) using %x or %s formatters, or (2) write arbitrary values to memory using %n formatter to corrupt function pointers, modify authentication flags, or achieve code execution. No user interaction is required (UI:N), making this suitable for automated or silent attacks. A proof-of-concept would likely demonstrate stack read/leak; memory write exploits would depend on ASLR and other mitigations present in Qsync Central's runtime environment. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 14, 2026
Format string vulnerability in QNAP Qsync Central that allows authenticated remote attackers to read sensitive data or modify memory without user interaction. The vulnerability affects all versions prior to Qsync Central 4.5.0.6 (released March 20, 2025), with a CVSS score of 8.1 indicating high severity. While no public exploit or KEV status is currently documented, the low attack complexity and requirement for only low-privilege user access make this a significant risk for organizations running vulnerable versions.
RemediationAI
Upgrade to Qsync Central version 4.5.0.6 or later immediately; priority: Critical Access Control: Restrict Qsync Central network access via firewall rules; limit exposure to trusted internal networks only. Implement IP whitelisting for API/service endpoints if accessible remotely.; priority: High Authentication: Enforce strong authentication (multi-factor authentication if available) for Qsync Central user accounts to raise the privilege barrier (currently requires only low-privilege authenticated access).; priority: High Monitoring: Monitor Qsync Central logs for unusual format string sequences (%x, %n, %s) in input parameters, API calls, or protocol messages; monitor for unexpected memory access patterns.; priority: Medium
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability stems from CWE-134 (Use of Externally-Controlled Format String), where user-controlled input is passed directly to format string functions without proper validation. In the context of Qsync Central, this likely occurs in logging, error handling, or network protocol parsing functions where attacker-supplied data reaches printf-family functions. The format string attack allows an attacker to read arbitrary memory locations (information disclosure) or write to memory addresses to modify program flow or data. Qsync Central is QNAP's cloud synchronization and file management service, typically running on NAS appliances and servers as a backend service component.
Know when Qsync Central gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
A use of externally-controlled format string vulnerability has been reported to affect Qsync Central. If exploited, the vulnerability could allow remote attackers who have gained user access to obtain secret data or modify memory.
We have already fixed the vulnerability in the following version: Qsync Central 4.5.0.6 ( 2025/03/20 ) and later
Executive ViewAI
QNAP Qsync Central versions prior to 4.5.0.6 contain a format string vulnerability allowing authenticated users to read sensitive data or modify system memory, creating risk of unauthorized access to protected information and potential system compromise. Organizations using Qsync Central must prioritize patching to prevent credential theft, configuration tampering, or lateral movement by low-privilege attackers.
Apply vendor patch. Interim mitigations if patching is delayed: restrict Qsync Central access to trusted network segments via firewall rules; enforce multi-factor authentication for all user accounts with Qsync Central access; monitor and log all Qsync Central authentication attempts and file operations; disable or isolate Qsync Central instances not actively required for business operations.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
More in Qsync Central
View allAn out-of-bounds write vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user accoun
SQL injection vulnerability in Qsync Central that allows authenticated remote attackers to execute arbitrary code or com
SQL injection in QNAP Qsync Central 5.0.0 (all builds prior to 5.0.0.2) allows a remote attacker who already holds a val
SQL injection in QNAP Qsync Central versions 5.0.0 through below 5.0.0.2 lets a remote attacker who already holds a vali
An improper certificate validation vulnerability has been reported to affect Qsync Central. Rated high severity (CVSS 8.
An improper certificate validation vulnerability has been reported to affect Qsync Central. Rated high severity (CVSS 8.
A buffer overflow vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, th
A buffer overflow vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, th
A buffer overflow vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, th
A buffer overflow vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, th
A use of externally-controlled format string vulnerability has been reported to affect Qsync Central. If a remote attack
A buffer overflow vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, th
GitHub PoC
Exploit-DB