EUVD-2025-211092
GHSA-9ww8-86rx-gwm9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain valid Qsync Central user account
-
ExploitSend oversized input to vulnerable parser
-
ImpactOverflow buffer, crash process or corrupt memory
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Buffer copy size validation
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to first gain a valid Qsync Central user account (PR:L, confirmed by both the CVSS vector and the description phrase 'if a remote attacker gains a user account'), so it is not exploitable by fully unauthenticated attackers. The CVSS 4.0 AT:P metric indicates a specific attack requirement/precondition must be met beyond simply reaching the service. Impact is limited to availability only (VA:L) - modifying memory or crashing processes - with no path to confidentiality or integrity compromise, which sharply limits realistic risk. Mitigated entirely by upgrading to Qsync Central 5.0.0.4 or later. |
| Impact | This is a genuinely low-priority issue, and the signals are consistent rather than conflicting. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L) yields a base score of only 0.6, driven by the requirement for a valid user account (PR:L), a specific attack requirement (AT:P), and an impact limited to low availability (VA:L) with no confidentiality or integrity consequences (VC:N/VI:N). The CVSS 4.0 exploit maturity metric is E:U (Unproven), meaning no public exploit identified at time of analysis. No EPSS score was provided and the CVE is not listed in CISA KEV, so there is no evidence of active exploitation or widespread exploit probability. The description aligns with the vector: 'if a remote attacker gains a user account' confirms authentication is required, and 'modify memory or crash processes' confirms the impact ceiling is a denial-of-service / minor memory corruption rather than code execution. There is no sign this is a high-CVSS-but-low-real-risk mismatch - both the score and the real-world signals point the same way: a low-severity, authenticated, availability-only flaw worth patching during routine maintenance, not as an emergency. |
| Exploit ScenarioDerived | An attacker who has already obtained valid credentials for a Qsync Central user account sends crafted oversized input to a vulnerable routine, which copies it without bounds checking (CWE-120), corrupting memory or crashing the affected process. No public proof-of-concept exists, and the impact is confined to denial of service or limited memory modification rather than remote code execution or data theft. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
Authenticated buffer overflow in QNAP Qsync Central (the QsyncServer app on QNAP NAS devices) prior to 5.0.0.4 allows a remote attacker who already holds a valid Qsync Central user account to corrupt memory or crash the Qsync process, degrading availability with no confirmed path to data theft or modification. The vulnerability is a classic CWE-120 buffer copy without input-size checking, and the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/C:N/I:N/A:L) confirms the impact is availability-only and gated behind account possession. There is no public exploit identified at time of analysis, no evidence of active exploitation, and an official fix is available in Qsync Central 5.0.0.4 and later, making this a low-priority, readily remediated issue.
RemediationAI
The vendor-released patch is Qsync Central 5.0.0.4 - upgrade the QsyncServer app to 5.0.0.4 or later on every QNAP NAS, using the QNAP App Center and verifying the installed version against the release notes at https://www.qnap.com/en/app-release-notes?keyword=Qsync%20&app=QsyncServer&product-line=nas. Because exploitation requires an existing valid Qsync Central account, the most effective compensating control is credential hygiene and least privilege: remove or disable unused Qsync accounts, rotate passwords for remaining users, and avoid granting sync accounts to untrusted parties - the trade-off is added user-management overhead and possible disruption for legitimate sharing workflows. If patching must be delayed, restrict network access to the Qsync service so only trusted networks/VPN clients can reach it, which reduces exposure to the AV:N attack surface but will break remote sync for off-network users; alternatively, temporarily stop the Qsync Central service on systems where sync is not required, at the cost of losing synchronization functionality. No public exploit code has been identified, so emergency out-of-band action beyond normal patch scheduling is not warranted.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-120, a buffer copy operation that does not validate the size of the input before copying, the classic memory-safety weakness underlying overflow and out-of-bounds write classes. In Qsync Central, QNAP's file-synchronization component for its NAS platform, this manifests as a remote-triggerable memory corruption that can either alter process memory or crash the Qsync service, which is why the only scored impact is availability (VA:L) rather than confidentiality or integrity. The vendor's own CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L) maps cleanly onto the independent CVSS 3.1 assessment: the network-reachable attack surface (AV:N) is real, but exploitation carries a precondition (AT:P) and requires a low-privileged authenticated account (PR:L), consistent with the description's statement that the attacker must first gain a user account. Both vectors agree that no confidentiality or integrity loss results, so the practical security value of the flaw lies almost entirely in denial-of-service against the sync service rather than in lateral movement or data compromise.
Know when Qnap gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Network-reachable service but requires a valid user account (PR:L); unchecked buffer copy yields only process crash/memory corruption, so A:L with no confidentiality or integrity impact.
Primary rating from Vendor (qnapsecurity).
CVSS VectorVendor: qnapsecurity
Lifecycle Timeline
2DescriptionCVE.org
A buffer copy without checking size of input vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes.
We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 and later
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
QNAP QTS before 4.2.4 Build 20170313 allows attackers to execute arbitrary commands via unspecified vectors. Rated criti
QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and obtain sensitive information
QNAP has patched a remote code execution vulnerability affecting the QTS Media Library in all versions prior to QTS 4.2.
QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and execute arbitrary commands vi
Exposure of Private Information in QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticate
QNAP QTS before 4.2.4 Build 20170313 allows local users to obtain sensitive Domain Administrator password information by
This command injection vulnerability in QTS allows attackers to run arbitrary commands in the compromised application. R
Command injection vulnerability in change password of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could
An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. Rated cr
This external control of file name or path vulnerability allows remote attackers to access or modify system files. Rated
Exploit-DB