QNAP Notification Center EUVD-2025-210096

Exploitation requires that a currently authenticated QNAP NAS user with access to Notification Center actively interacts with attacker-controlled content - by clicking a malicious link or visiting a crafted webpage while an active session cookie is present in their browser. The CVSS 4.0 vector explicitly requires active user interaction (UI:A), making passive drive-by exploitation impossible. The attacker requires no privileges (PR:N) and no special attack configuration (AC:L/AT:N). Exploitation is limited by the mandatory user interaction step, the narrow impact scope (integrity modification within Notification Center only, VI:L), the absence of subsequent system compromise, and the requirement that the victim's NAS management interface be reachable from the attacker's delivery mechanism. Non-default configurations or specific Notification Center features are not cited as prerequisites.

The CVSS 4.0 base score of 5.1 (Medium) is consistent with the constrained impact profile: integrity-only effect on the vulnerable system (VI:L) with no confidentiality or availability impact, and no subsequent system compromise (SC:N/SI:N/SA:N). The mandatory active user interaction (UI:A) meaningfully reduces exploitability compared to fully passive CSRF chains. No EPSS score was provided in the available data, so exploitation probability cannot be quantified. This CVE is not listed in the CISA KEV catalog and no POC has been identified, indicating no confirmed active exploitation. Real-world risk is primarily limited to targeted social-engineering attacks against QNAP NAS administrators - a narrower population than general internet users. The low impact ceiling (privilege manipulation within Notification Center, not root-level NAS compromise) further tempers urgency, though organizations with internet-exposed QNAP management interfaces should treat this with higher priority given QNAP's historical targeting by ransomware actors.

An attacker crafts a malicious webpage embedding a hidden form or JavaScript that submits a forged HTTP request to the QNAP Notification Center endpoint. The attacker then sends a phishing email or plants a link to lure an authenticated QNAP administrator into visiting the page, at which point the browser automatically submits the request with the victim's session cookies, executing unauthorized actions such as modifying notification configurations or escalating the attacker's access level within the Notification Center. No public exploit code has been identified at time of analysis.