CVE-2025-30276 is an out-of-bounds write vulnerability in QNAP Systems Inc. 's Qsync Central version 5.0.x.x. A remote attacker with a valid user account can exploit this flaw to corrupt or modify memory, potentially leading to system instability or unauthorized behavior. The vulnerability does not require user interaction and has a medium severity with a CVSS score of 4.9. It was fixed in Qsync Central version 5.0.
CVE-2025-47205 is a medium-severity NULL pointer dereference vulnerability affecting QNAP QTS operating system versions 5.2.x. An attacker with administrator privileges can exploit this flaw to cause a denial-of-service (DoS) condition, disrupting system availability. The vulnerability does not require user interaction and has a CVSS 4.0 base score of 5.1, indicating moderate risk. It has been fixed in QTS 5.2.8.
CVE-2025-47209 is a NULL pointer dereference vulnerability in QNAP Systems Inc. 's Qsync Central software, affecting version 5.0.x.x. A remote attacker with a valid user account can exploit this flaw to cause a denial-of-service (DoS) condition, crashing or disrupting the service. The vulnerability requires no user interaction but does require authenticated access, limiting the attack surface. The issue has been fixed in Qsync Central version 5.0.0.
CVE-2025-48722 is a low-severity NULL pointer dereference vulnerability in QNAP Systems Inc. 's Qsync Central version 5.0.x.x. A remote attacker with an existing user account can exploit this flaw to cause a denial-of-service (DoS) condition, crashing or disrupting the service. The vulnerability does not require user interaction and has a low CVSS score of 1.3, indicating limited impact and ease of exploitation. The issue has been fixed in Qsync Central version 5.0.
CVE-2025-48723 is a buffer overflow vulnerability in QNAP Systems Inc. 's Qsync Central software, specifically affecting version 5.0.x.x. A remote attacker who has obtained a user account with limited privileges can exploit this flaw to modify memory or cause process crashes, potentially leading to denial of service or further exploitation. The vulnerability does not require user interaction but does require authentication with a user-level account. The issue has been fixed in Qsync Central version 5.0.0.
CVE-2025-48724 is a buffer overflow vulnerability in QNAP Systems Inc. 's Qsync Central product affecting version 5.0.x.x. A remote attacker with a valid user account can exploit this flaw to modify memory or crash processes without requiring user interaction. The vulnerability is classified under CWE-120, indicating a classic buffer overflow issue. The vendor has released a fix in Qsync Central version 5.0.0.
CVE-2025-48725 is a buffer overflow vulnerability in QNAP Systems Inc. 's QuTS hero operating system versions h5.3.x. A remote attacker with a valid user account can exploit this flaw to modify memory or crash processes, potentially causing denial of service or instability. The vulnerability requires low privileges (a user account) but no user interaction. It has a low CVSS 4.0 score of 0.6 due to limited impact and exploitation complexity. The issue is fixed in QuTS hero version h5.
CVE-2025-52868 is a buffer overflow vulnerability in QNAP Systems Inc. 's Qsync Central product affecting version 5.0.x.x. A remote attacker with a valid user account can exploit this flaw to modify memory or crash processes, potentially disrupting service or causing instability. The vulnerability does not require user interaction but does require low-level privileges (a user account). It has a low CVSS 4.0 score of 0.6, reflecting limited impact and exploitation complexity.
CVE-2025-52869 is a buffer overflow vulnerability in QNAP Systems Inc. 's Qsync Central software, specifically affecting version 5.0.x.x. A remote attacker with a valid user account can exploit this flaw to modify memory or crash processes, potentially disrupting service or causing instability. The vulnerability does not require user interaction but does require low-level privileges (a user account). The issue has been fixed in Qsync Central version 5.0.0.
CVE-2025-52870 is a buffer overflow vulnerability in QNAP Systems Inc. 's Qsync Central product affecting version 5.0.x.x. A remote attacker with a valid user account can exploit this flaw to modify memory or crash processes, potentially leading to denial of service or other unintended behavior. The vulnerability requires low privileges (a user account) but no user interaction and has a low CVSS score of 0.6. QNAP has released a fix in version 5.0.
CVE-2025-53598 is a NULL pointer dereference vulnerability in QNAP Systems Inc. 's Qsync Central affecting version 5.0.x.x. A remote attacker with a valid user account can exploit this flaw to cause a denial-of-service (DoS) condition, disrupting service availability. The vulnerability does not require user interaction but does require low-level privileges (a user account). The issue has been fixed in Qsync Central version 5.0.0.
CVE-2025-54146 is a low-severity NULL pointer dereference vulnerability in QNAP Systems Inc. 's Qsync Central version 5.0.x.x. A remote attacker with a valid user account can exploit this flaw to cause a denial-of-service (DoS) condition, crashing or disrupting the service. The vulnerability does not require user interaction, but does require authenticated access, limiting its exploitation scope. QNAP has addressed this issue in Qsync Central version 5.0.0.
CVE-2025-54147 is a NULL pointer dereference vulnerability in QNAP Systems Inc. 's Qsync Central version 5.0.x.x. A remote attacker with a valid user account can exploit this flaw to cause a denial-of-service (DoS) condition, crashing or disrupting the service. The vulnerability has a low CVSS score of 1.3, reflecting limited impact and exploitation complexity. No user interaction or elevated privileges beyond a user account are required. The issue has been fixed in Qsync Central version 5.
CVE-2025-54148 is a NULL pointer dereference vulnerability in QNAP Systems Inc. 's Qsync Central product, specifically affecting version 5.0.x.x. A remote attacker with a valid user account can exploit this flaw to cause a denial-of-service (DoS) condition, crashing or disrupting the service. The vulnerability does not require user interaction and has a low CVSS score of 1.3, indicating limited impact and ease of exploitation. The issue has been fixed in Qsync Central version 5.0.
CVE-2025-54149 is an uncontrolled resource consumption vulnerability in QNAP Systems Inc. 's Qsync Central version 5.0.x.x. A local attacker with a valid user account can exploit this flaw to launch a denial-of-service (DoS) attack, potentially disrupting service availability. The vulnerability does not require user interaction or network-level authentication but does require local user privileges. It has a CVSS 4.9 (medium) score, reflecting moderate impact and ease of exploitation. The issue has been fixed in Qsync Central version 5.
CVE-2025-54150 is an uncontrolled resource consumption vulnerability affecting QNAP Systems Inc. 's Qsync Central version 5.0.x.x. A local attacker with a valid user account can exploit this flaw to launch a denial-of-service (DoS) attack by exhausting system resources. The vulnerability does not require user interaction or elevated privileges beyond a user account. It has a CVSS v4.0 base score of 4.9, indicating medium severity.
CVE-2025-54151 is an uncontrolled resource consumption vulnerability in QNAP Systems Inc. 's Qsync Central version 5.0.x.x. A local attacker with a valid user account can exploit this flaw to launch a denial-of-service (DoS) attack by exhausting system resources. The vulnerability does not require user interaction or elevated privileges beyond a user account. It has a CVSS 4.9 (medium) severity score and was fixed in Qsync Central version 5.0.
CVE-2025-54152 is a low-severity vulnerability in QNAP Systems Inc. 's Qsync Central version 5.0.x.x, involving a use of out-of-range pointer offset (CWE-823). A remote attacker with a valid user account can exploit this flaw to read sensitive memory portions, potentially exposing confidential data. The vulnerability requires no user interaction but does require authenticated access, limiting its exploitation scope. The issue has been fixed in Qsync Central version 5.0.0.
CVE-2025-54155 is a resource allocation vulnerability in QNAP Systems Inc. 's File Station 5, affecting versions 5.5.x prior to 5.5.6.5018. A remote attacker with administrator privileges can exploit this flaw to exhaust resources without limits or throttling, potentially denying access to those resources for other systems, applications, or processes. The vulnerability requires high privileges and does not need user interaction. Although the CVSS score is low (3.
CVE-2025-54161 is a resource allocation vulnerability in QNAP File Station 5 versions 5.5.x that allows a remote attacker with administrator privileges to exhaust system resources without limits or throttling. This can lead to denial of service conditions affecting other systems, applications, or processes relying on the same resources. The vulnerability does not require user interaction but does require high privileges (administrator access). It has a low CVSS score of 3.6, reflecting limited impact and exploitation complexity. The issue has been fixed in File Station 5 version 5.5.6.
