CVE-2025-54168: QNAP QuLog Center XSS Vulnerability

CVE-2025-54168 Overview

CVE-2025-54168 is a cross-site scripting (XSS) vulnerability affecting QNAP QuLog Center. An authenticated attacker holding an administrator account can inject script content that bypasses security mechanisms or exposes application data. QNAP addressed the flaw in QuLog Center version 1.8.2.923 released on 2025/08/27. The issue is tracked under CWE-79 and documented in the QNAP Security Advisory QSA-25-42.

Critical Impact
An authenticated administrator can inject scripts to bypass security controls or access sensitive application data within QuLog Center.

Affected Products

QNAP QuLog Center versions prior to 1.8.2.923
QNAP NAS devices running vulnerable QuLog Center builds
QNAP centralized log management deployments across NAS fleets

Discovery Timeline

2025/08/27 - QNAP releases QuLog Center 1.8.2.923 with the fix
2025-11-07 - CVE-2025-54168 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54168

Vulnerability Analysis

QuLog Center is QNAP's centralized log management application for NAS devices. It aggregates system and access logs from multiple appliances through a web-based interface. The vulnerability is a stored or reflected XSS flaw classified under [CWE-79], where user-controlled input is rendered in the web UI without adequate encoding or sanitization.

Exploitation requires a valid administrator session, which limits the practical attack surface. Once triggered, injected JavaScript executes within the browser context of a QuLog Center user, potentially reading application data or issuing requests that bypass client-side security checks.

The attack requires user interaction, consistent with typical XSS payload delivery through rendered log entries or configuration fields. The scope changes because injected script executes in the browser context outside the original vulnerable component.

Root Cause

The root cause is improper neutralization of input during web page generation. QuLog Center fails to encode or sanitize specific fields before rendering them in the administrative interface, allowing HTML and JavaScript payloads to persist and execute.

Attack Vector

An attacker who already possesses administrator credentials or has compromised an administrator account injects a crafted payload into a field processed by QuLog Center. When another privileged user views the affected view, the browser executes the payload. The vulnerability requires network access to the QuLog Center interface and user interaction to trigger the payload. Public proof-of-concept code is not available, and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog.

See the QNAP Security Advisory QSA-25-42 for vendor guidance.

Detection Methods for CVE-2025-54168

Indicators of Compromise

Unexpected <script>, onerror=, or javascript: fragments in QuLog Center log entries, saved filters, or configuration fields
Administrator sessions issuing anomalous API requests immediately after loading log views
New or modified administrator accounts on QNAP NAS devices that host QuLog Center
QuLog Center running a version earlier than 1.8.2.923

Detection Strategies

Inventory QNAP NAS devices and confirm the installed QuLog Center version against 1.8.2.923
Review web server and application logs for requests containing HTML entities or script tags targeting QuLog Center endpoints
Correlate administrator authentication events with subsequent configuration changes to detect account compromise preceding XSS abuse

Monitoring Recommendations

Enable audit logging on QNAP administrator accounts and forward events to a centralized SIEM
Alert on outbound HTTP requests from administrator browsers to unrecognized domains after QuLog Center sessions
Track QuLog Center software update status across the fleet to detect unpatched instances

How to Mitigate CVE-2025-54168

Immediate Actions Required

Upgrade QuLog Center to version 1.8.2.923 or later on all QNAP NAS devices
Rotate administrator credentials and enforce multi-factor authentication on QNAP accounts
Restrict administrative access to QuLog Center to trusted management networks only
Review recent administrator activity for signs of unauthorized configuration changes

Patch Information

QNAP fixed the issue in QuLog Center 1.8.2.923, released on 2025/08/27. Administrators should install the update through the QNAP App Center or download it directly from QNAP. Refer to the QNAP Security Advisory QSA-25-42 for release details.

Workarounds

Limit QuLog Center administrator accounts to the minimum number required for operations
Place QNAP management interfaces behind a VPN or restricted network segment
Use a browser with strict Content Security Policy enforcement when accessing QuLog Center until patching is complete

bash

# Verify QuLog Center version on a QNAP NAS via SSH
qpkg_cli --list | grep -i qulog

# Expected output should show version 1.8.2.923 or later