Qsync Central EUVD-2025-32451

Exploitation requires the attacker to first possess a valid Qsync Central user account (PR:L) - the vulnerability cannot be triggered by a fully unauthenticated attacker. Given that, no user interaction is needed (UI:N) and the attack is network-reachable (AV:N) with low complexity (AC:L) against affected versions Qsync Central 5.0.0 through below 5.0.0.2. Limiting factors: the account prerequisite, exposure of the Qsync Central service to the attacker's network, and running an unpatched version prior to 5.0.0.2 (released 2025/07/31); environments that restrict account creation and network reachability or have patched are not exposed.

The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N) scores 8.6 (High), indicating a network-reachable, low-complexity SQL injection that requires an authenticated user account (PR:L) and no user interaction, yielding high confidentiality and integrity impact with no availability impact. These signals are internally consistent with the description, which explicitly states a remote attacker must first gain a user account. The EPSS score is low at 0.09% (26th percentile), indicating a low modeled probability of exploitation in the near term. The CVE is NOT on CISA KEV and no public exploit code is referenced in the provided data, so there is no public exploit identified at time of analysis. The combination - authentication requirement plus low EPSS plus no POC/KEV - tempers the high CVSS: this is a credible but not urgent issue. It is a real priority only for environments where Qsync Central is internet-exposed and low-privilege accounts are easily obtainable (e.g., many user accounts, weak onboarding). The 'execute unauthorized code or commands' phrasing in the description is broader than a typical SQLi data-disclosure outcome; however, the vendor vector sets VA:N (no availability impact) and does not indicate a scope change, so the practical impact is best read as database read/write (confidentiality and integrity) rather than full OS command execution - this discrepancy between description wording and the CVSS vector should be verified with the vendor advisory QSA-25-35.

An attacker who holds or obtains a low-privilege Qsync Central user account sends a crafted request containing malicious SQL to an injectable parameter, manipulating backend database queries to read or alter data beyond their authorization. No public exploit code is identified at time of analysis, and no user interaction is required once valid credentials are held.