QNAP Qsync Central EUVD-2025-32485

Exploitation requires the attacker to first hold a valid Qsync Central user account (PR:L) - it is NOT unauthenticated. Once authenticated, the flaw is network-reachable (AV:N) with low complexity (AC:L) and no user interaction (UI:N), so any authenticated user can trigger it against default configurations. The exact product feature that lacks throttling is not named in the vendor description beyond the general CWE-770 resource-allocation behavior. The primary limiting factor is the authentication requirement: attackers need working credentials, which restricts exploitation to insiders, credential-theft scenarios, or environments with weak/shared accounts. Impact is limited to availability (denial of service); no data disclosure or modification occurs.

This is a resource-exhaustion denial-of-service flaw (CWE-770) in QNAP Qsync Central. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H) is internally consistent with the description: network-reachable, low attack complexity, requires a low-privileged authenticated user account (PR:L, matching the description's 'if a remote attacker gains a user account'), and produces only an availability impact (VA:H) with no confidentiality or integrity loss. Real-world risk signals point to LOW-to-MODERATE priority rather than an urgent emergency: EPSS is only 0.15% (36th percentile), the vulnerability is NOT on the CISA KEV list, and no public exploit code is identified in the provided data. The CVSS score of 7.1 is driven primarily by the high availability impact combined with network reach, but the PR:L requirement meaningfully constrains exploitation to attackers who already hold valid credentials. No signals conflict - all sources (low EPSS, no KEV, no POC) agree this is not under active exploitation. The practical takeaway: patch during normal maintenance cycles, prioritize internet-exposed instances, but this is not a drop-everything emergency.

An attacker who has obtained a valid Qsync Central user account (via phishing, credential reuse, or an insider) sends requests that trigger uncapped resource allocation, exhausting the shared resource until legitimate systems, applications, or processes can no longer access it. No public exploit code was identified at time of analysis, and the low attack complexity (AC:L) means no special timing or conditions are needed once authenticated.