CVE-2025-29896
NULL Pointer Dereference in qsyncsrv.cgi
QNAP Systems Inc. Qsync Central
CVSS
2.3LowExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.27%Chance of exploitation activity in the next 30 days, higher than 18% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 5.0.0.4Qsync CentralCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.
We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 and later
Text from CVE List
Affected versions 1
- Qsync Centralaffected: 5.0.x before 5.0.0.4CVE List