CVE-2025-53595
Published: 03 October 2025
Summary
CVE-2025-53595 is a high-severity SQL Injection (CWE-89) vulnerability in Qnap Qsync Central. Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 29.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-53595 is an SQL injection vulnerability (CWE-89) affecting Qsync Central, a component of QNAP systems. The issue allows unauthorized code or command execution and has a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its network accessibility, low attack complexity, and significant impacts on confidentiality, integrity, and availability.
A remote attacker who first obtains a valid user account on the affected Qsync Central instance can exploit the SQL injection flaw to execute arbitrary code or commands. This requires low privileges (PR:L) but no user interaction, enabling privilege escalation or further system compromise from a remote position.
QNAP's security advisory (QSA-25-35) confirms the vulnerability has been addressed in Qsync Central version 5.0.0.2, released on 2025/07/31, and all subsequent versions. Security practitioners should update to these patched releases immediately to mitigate the risk.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-32451
Vulnerability details
An SQL injection vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following…
more
version: Qsync Central 5.0.0.2 ( 2025/07/31 ) and later
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in network-accessible Qsync Central service directly enables remote exploitation of a public-facing application (T1190) leading to arbitrary code/command execution (T1059).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents SQL injection vulnerabilities like CVE-2025-53595 by requiring validation and sanitization of user inputs to block malicious SQL code execution.
Ensures timely identification, reporting, and patching of flaws, directly mitigating CVE-2025-53595 through application of QNAP's fixed version 5.0.0.2.
Monitors and scans for vulnerabilities such as the SQL injection in Qsync Central, enabling detection and proactive remediation before exploitation.