QNAP License Center up to 2.0.35 stack-based overflow

Summaryinfo

A vulnerability classified as critical was found in QNAP License Center up to 2.0.35. This affects an unknown function. The manipulation results in stack-based overflow. This vulnerability is reported as CVE-2025-53597. The attack can be launched remotely. No exploit exists. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as critical, was found in QNAP License Center up to 2.0.35. Affected is an unknown function. The manipulation with an unknown input leads to a stack-based overflow vulnerability. CWE is classifying the issue as CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

A buffer overflow vulnerability has been reported to affect License Center. If a remote attacker gains an administrator account, they can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following version: License Center 2.0.36 and later

The weakness was disclosed by coral as qsa-25-52. The advisory is available at qnap.com. This vulnerability is traded as CVE-2025-53597 since 07/04/2025. The exploitability is told to be easy. It is possible to launch the attack remotely. Additional levels of successful authentication are required for exploitation. The technical details are unknown and an exploit is not available.

Upgrading to version 2.0.36 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-0669). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• QNAP

Name

• License Center

Version

• 2.0.0
• 2.0.1
• 2.0.2
• 2.0.3
• 2.0.4
• 2.0.5
• 2.0.6
• 2.0.7
• 2.0.8
• 2.0.9
• 2.0.10
• 2.0.11
• 2.0.12
• 2.0.13
• 2.0.14
• 2.0.15
• 2.0.16
• 2.0.17
• 2.0.18
• 2.0.19
• 2.0.20
• 2.0.21
• 2.0.22
• 2.0.23
• 2.0.24
• 2.0.25
• 2.0.26
• 2.0.27
• 2.0.28
• 2.0.29
• 2.0.30
• 2.0.31
• 2.0.32
• 2.0.33
• 2.0.34
• 2.0.35

License

• commercial

Website

• Vendor: https://www.qnap.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion