CVE-2025-48724
Published: 11 February 2026
Summary
CVE-2025-48724 is a low-severity Classic Buffer Overflow (CWE-120) vulnerability in Qnap Qsync Central. Its CVSS base score is 0.6 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 29.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2025-48724 is a buffer overflow vulnerability (CWE-120, CWE-122) affecting Qsync Central. Published on 2026-02-11, it carries a CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H), indicating high severity due to its potential for network-based exploitation with low complexity and privileges.
A remote attacker who has gained a user account can exploit the vulnerability to modify memory or crash processes, resulting in high integrity and availability impacts without affecting confidentiality or requiring user interaction.
QNAP has fixed the vulnerability in Qsync Central version 5.0.0.4, released on 2026/01/20, and later versions. Additional details are available in the vendor's security advisory at https://www.qnap.com/en/security-advisory/qsa-26-02.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-207449
Vulnerability details
A buffer overflow vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following…
more
version: Qsync Central 5.0.0.4 ( 2026/01/20 ) and later
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in network-accessible Qsync Central service directly enables remote authenticated exploitation of a public-facing application (T1190) and application-layer DoS via process crash (T1499.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Implements memory protection mechanisms like ASLR and DEP to directly prevent buffer overflow exploits from modifying memory or enabling code execution.
Validates input lengths and formats to Qsync Central to block oversized or malformed data that triggers the buffer overflow.
Requires timely remediation of identified flaws, such as applying the vendor patch for CVE-2025-48724 to eliminate the buffer overflow vulnerability.