Qsync Central EUVD-2025-32442

Exploitation requires the attacker to already hold a valid Qsync Central user account (CVSS PR:L), so this is an authenticated attack reachable over the network against QNAP Qsync Central versions 5.0.0 up to but not including 5.0.0.2. The AT:P attack requirement indicates exploitation depends on conditions not fully under the attacker's control, so success is not guaranteed on every attempt. Key limiting factors: a credentialed account is mandatory (no unauthenticated path), impact is confined to availability/service disruption with no data exposure or code execution, and upgrading to Qsync Central 5.0.0.2 (released 2025/07/31) or later fully remediates. Real-world risk concentrates on deployments where Qsync Central is network-exposed and where user accounts can be obtained or are weakly protected.

This is a moderate, not top-tier, priority. The vendor-supplied CVSS:4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N) scores 6.0 and describes a network-reachable, low-complexity attack that nevertheless requires an authenticated user account (PR:L) and carries an attack requirement (AT:P), meaning exploitation is not fully reliable against any target by default. Impact is limited to availability (VA:H) with no confidentiality or integrity effect (VC:N/VI:N) - consistent with the CWE-400 uncontrolled resource consumption / DoS classification. The signals align rather than conflict: EPSS is low at 0.15% (36th percentile), the CVE is NOT on CISA KEV, and no public exploit code was identified, so there is no evidence of widespread or active exploitation. The requirement for a valid account meaningfully narrows the threat to insiders or attackers who have already obtained credentials, further reducing real-world urgency. Net: a legitimate but availability-only, authentication-gated issue - patch in normal cycles rather than as an emergency, prioritizing internet-exposed QNAP deployments where account compromise is plausible.

An attacker who has obtained or been granted a low-privileged Qsync Central user account sends requests that trigger uncontrolled resource consumption, exhausting CPU, memory, or another finite resource and rendering the service unavailable to legitimate users. No public proof-of-concept was identified, and because availability is the only impact, the scenario results in service disruption rather than data theft or code execution.