CVE-2025-54167: Notification Center XSS Vulnerability

CVE-2025-54167 Overview

CVE-2025-54167 is a stored cross-site scripting (XSS) vulnerability affecting QNAP Notification Center. An authenticated remote attacker holding an administrator account can inject malicious script content that executes in the browser context of other users. Successful exploitation allows the attacker to bypass security mechanisms or read application data. The flaw is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation. QNAP has released fixed builds of Notification Center across the 1.9.x, 2.1.x, and 3.0.x branches.

Critical Impact
An attacker with administrator privileges can execute arbitrary script in the Notification Center web interface, leading to data disclosure and security-control bypass.

Affected Products

QNAP Notification Center versions prior to 2.1.0.3443
QNAP Notification Center versions prior to 1.9.2.3163
QNAP Notification Center versions prior to 3.0.0.3466

Discovery Timeline

2025-11-07 - CVE-2025-54167 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-54167

Vulnerability Analysis

The vulnerability resides in QNAP Notification Center, a component used to manage system alerts and external notification delivery on QNAP NAS appliances. Notification Center fails to properly neutralize user-supplied input before rendering it in the web interface. An attacker who controls input written into notification-related fields can store JavaScript payloads that execute when a privileged user views the affected view.

Because exploitation requires an administrator account, the immediate risk is post-authentication. However, the impact still extends beyond the attacker's existing privileges. Script execution in the management UI can be used to exfiltrate session data, read application content, and pivot against security mechanisms enforced client-side.

Root Cause

The root cause is improper output encoding of input rendered into the Notification Center web pages, consistent with CWE-79. Input that should be treated as data is interpreted as HTML or JavaScript by the browser when it is rendered into the DOM without contextual escaping.

Attack Vector

The attack vector is network-based and requires high privileges plus user interaction. An attacker first obtains an administrator account on the QNAP device through credential theft, reuse, or another compromise. The attacker then submits a crafted payload through a Notification Center input that is stored and later rendered to other users. When a targeted user loads the affected page, the script executes in their browser session against the NAS web origin.

No verified public exploit code or proof-of-concept has been released for this issue. Refer to the QNAP Security Advisory QSA-25-40 for vendor technical details.

Detection Methods for CVE-2025-54167

Indicators of Compromise

Notification Center entries, rules, or message templates containing HTML tags, <script> blocks, javascript: URIs, or event handlers such as onerror= and onload=.
Unexpected outbound HTTP requests from administrator browsers to attacker-controlled hosts shortly after viewing Notification Center pages.
Administrator session tokens used from unfamiliar IP addresses or user agents following Notification Center activity.

Detection Strategies

Audit Notification Center configuration data for stored input containing script tags, encoded payloads, or non-printable characters.
Inspect QNAP web access logs for POST requests to Notification Center endpoints from accounts that do not normally administer notifications.
Correlate administrator logins, configuration changes, and subsequent anomalous browser-originated network traffic to identify possible XSS-driven actions.

Monitoring Recommendations

Enable and forward QNAP system and access logs to a centralized logging or SIEM platform for retention and search.
Alert on creation or modification of administrator accounts on QNAP devices, since administrator access is a prerequisite for exploitation.
Monitor endpoints used by NAS administrators for browser-based script execution anomalies and unauthorized data transfers.

How to Mitigate CVE-2025-54167

Immediate Actions Required

Update Notification Center to version 2.1.0.3443, 1.9.2.3163, 3.0.0.3466 or later, matching the branch installed on each device.
Review existing Notification Center configurations and remove any stored entries that contain script content or unexpected HTML.
Rotate credentials for all QNAP administrator accounts and verify that no unauthorized administrator accounts have been added.

Patch Information

QNAP has released fixed versions of Notification Center. Install Notification Center 2.1.0.3443 or later, 1.9.2.3163 or later, or 3.0.0.3466 or later through the QNAP App Center. Full vendor guidance is published in QNAP Security Advisory QSA-25-40.

Workarounds

Restrict access to the QNAP management interface to trusted administrative networks using firewall rules or VPN.
Enforce multi-factor authentication on all administrator accounts to reduce the likelihood of an attacker obtaining the privileges required for exploitation.
Limit the number of accounts holding administrator privileges and apply least privilege to delegated roles until patching is complete.

bash

# Verify the installed Notification Center version on a QNAP device
# (run via SSH as an administrator)
qpkg_cli --list | grep -i "Notification Center"