BaseFortify

Publication date: 2025-10-03

Last updated on: 2025-10-08

Assigner: QNAP Systems, Inc.

Description

An uncontrolled resource consumption vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.2 ( 2025/07/31 ) and later

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-03

Last Modified

2025-10-08

Generated

2026-07-06

AI Q&A

2025-10-03

EPSS Evaluated

2026-07-05

NVD

CVE-2025-52867

Affected Vendors & Products

Vendor	Product	Version / Range
qnap	qsync_central	From 5.0.0.0 (inc) to 5.0.0.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability is an uncontrolled resource consumption issue in Qsync Central. If a remote attacker obtains a user account, they can exploit this flaw to launch a denial-of-service (DoS) attack against the system.

Impact Analysis

The vulnerability can allow an attacker with a user account to cause a denial-of-service (DoS) attack, potentially making the Qsync Central service unavailable or severely degraded.

Mitigation Strategies

To mitigate this vulnerability, update Qsync Central to version 5.0.0.2 (released on 2025/07/31) or later.

Hi! I’m here to help you understand CVE-2025-52867. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70