CVE-2025-52870
Published: 11 February 2026
Summary
CVE-2025-52870 is a low-severity Classic Buffer Overflow (CWE-120) vulnerability in Qnap Qsync Central. Its CVSS base score is 0.6 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 29.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2025-52870 is a buffer overflow vulnerability (CWE-120, CWE-122) affecting Qsync Central, with a CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H). Published on 2026-02-11, the flaw allows unauthorized memory manipulation or process crashes when exploited.
A remote attacker who has obtained a user account (PR:L) can exploit the vulnerability over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N). Successful exploitation enables modification of memory, compromising integrity (I:H), or crashing processes, disrupting availability (A:H), while maintaining an unchanged scope (S:U) and no confidentiality impact (C:N).
QNAP's security advisory (QSA-26-02) confirms the vulnerability has been fixed in Qsync Central version 5.0.0.4, released on 2026/01/20, and all later versions. Security practitioners should update affected systems immediately; details are available at https://www.qnap.com/en/security-advisory/qsa-26-02.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-206912
Vulnerability details
A buffer overflow vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following…
more
version: Qsync Central 5.0.0.4 ( 2026/01/20 ) and later
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote network-accessible buffer overflow enabling memory manipulation or DoS in Qsync Central service directly maps to exploitation of a public-facing (or remotely reachable) application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely application of vendor patches, directly mitigating this buffer overflow vulnerability fixed in Qsync Central 5.0.0.4.
Implements memory protection mechanisms like stack canaries, ASLR, and DEP to prevent exploitation of buffer overflows leading to memory modification or crashes.
Enforces validation of inputs to prevent oversized or malformed data from triggering the buffer overflow in Qsync Central.