A NULL pointer dereference flaw in qsyncsrv.cgi allows a remote attacker who has gained a legitimate user account to trigger an immediate denial of service on the Qsync Central server. The flaw is classified as CWE-476 and carries a CVSS score of 2.3, indicating a low severity impact that primarily disrupts availability rather than compromising confidentiality or integrity.

The vulnerability affects QNAP Systems Inc.'s Qsync Central service. No specific product versions are listed in the advisory, but an update that addresses the flaw is available in Qsync Central 5.0.0.4 and later. Existing deployments that rely on earlier versions remain at risk.

The EPSS score of < 1% suggests that exploitation is unlikely, and the vulnerability is not listed in the CISA KEV catalog. With a CVSS score of 2.3, the flaw is considered low severity. Nevertheless, an attacker who can authenticate to the Web UI would need only to trigger the vulnerable code path to cause a service crash. Remote execution of the attack requires a legitimate user account, reducing the attack surface but still offering a feasible DoS vector against unattended or poorly monitored systems.