CVE-2025-54150

Analyzed Analyzed - Analysis Complete

Uncontrolled Resource Consumption in Qsync Central Enables DoS Attack

Publication date: 2026-02-11

Last updated on: 2026-02-12

Assigner: QNAP Systems, Inc.

Description

An uncontrolled resource consumption vulnerability has been reported to affect Qsync Central. If a local attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 ( 2026/01/20 ) and later

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-02-11

Last Modified

2026-02-12

Generated

2026-07-06

AI Q&A

2026-02-11

EPSS Evaluated

2026-07-05

NVD

CVE-2025-54150

Affected Vendors & Products

Vendor	Product	Version / Range
qnap	qsync_central	From 5.0.0.0 (inc) to 5.0.0.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
CWE-789	The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability is an uncontrolled resource consumption issue affecting Qsync Central. It allows a local attacker who has a user account to exploit the system and launch a denial-of-service (DoS) attack.

Impact Analysis

The vulnerability can impact you by enabling a local attacker with a user account to cause a denial-of-service (DoS) attack, which could disrupt the availability of the Qsync Central service.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Qsync Central to version 5.0.0.4 or later, where the issue has been fixed.

Since the vulnerability requires a local attacker with a user account, limiting user access and monitoring for unusual resource consumption may also help reduce risk until the update is applied.

Hi! I’m here to help you understand CVE-2025-54150. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70