Cyber Posture

CVE-2025-30276

High

Published: 11 February 2026

Published
11 February 2026
Modified
11 February 2026
KEV Added
Patch
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0006 18.4th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-30276 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Qnap Qsync Central. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 18.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Implements memory protection mechanisms that directly prevent out-of-bounds writes from modifying or corrupting memory as exploited in this CVE.

prevent

Enforces input validation to reject malformed data that could trigger the out-of-bounds write vulnerability in Qsync Central.

prevent

Requires timely remediation of the specific out-of-bounds write flaw via patching to Qsync Central 5.0.0.4 or later.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Out-of-bounds write in remotely accessible Qsync Central service directly enables remote exploitation of a public-facing application by an authenticated attacker.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

An out-of-bounds write vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to modify or corrupt memory. We have already fixed the vulnerability in the following version:…

more

Qsync Central 5.0.0.4 ( 2026/01/20 ) and later

Deeper analysisAI

CVE-2025-30276 is an out-of-bounds write vulnerability (CWE-787) affecting Qsync Central. Published on 2026-02-11, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impacts across confidentiality, integrity, and availability.

A remote attacker who has gained a user account can exploit the vulnerability over the network with low complexity and no user interaction required. Successful exploitation allows the attacker to modify or corrupt memory on the affected system.

QNAP has fixed the vulnerability in Qsync Central version 5.0.0.4, released on 2026/01/20, and all later versions. Additional details are available in the vendor's security advisory at https://www.qnap.com/en/security-advisory/qsa-26-02.

Details

CWE(s)

Affected Products

qnap
qsync central
5.0.0.0 — 5.0.0.4

CVEs Like This One

CVE-2025-44014Same product: Qnap Qsync Central
CVE-2025-29894Same product: Qnap Qsync Central
CVE-2025-52870Same product: Qnap Qsync Central
CVE-2025-57709Same product: Qnap Qsync Central
CVE-2025-30269Same product: Qnap Qsync Central
CVE-2025-54153Same product: Qnap Qsync Central
CVE-2025-48724Same product: Qnap Qsync Central
CVE-2025-53595Same product: Qnap Qsync Central
CVE-2025-48723Same product: Qnap Qsync Central
CVE-2025-30277Same product: Qnap Qsync Central

References