A buffer copy operation in the qsyncsrv.cgi component of Qsync Central does not check the size of input data, creating a stack-based buffer overflow. The flaw can be triggered by a remote attacker who already possesses a valid user account. Once exploited, the attacker may alter memory contents or cause process crashes, potentially leading to unauthorized code execution or denial of service. The vulnerability directly impacts confidentiality, integrity and availability of the affected system.

QNAP Systems Inc. offers the affected product Qsync Central. Versions of Qsync Central released prior to 5.0.0.4 are vulnerable. The vendor has fixed the issue in release 5.0.0.4 and later, so any deployment running the older firmware is impacted.

The published CVSS score of 2.3 indicates a low severity risk. EPSS is reported as less than 1%, reflecting a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires remote access over HTTP to the CGI handler and a pre‑existing authenticated user account. While the flaw permits memory corruption, there is no evidence of successful remote code execution yet; thus the practical impact is a potential for denial of service or, at best, a starting point for privilege escalation if additional weaknesses exist.