EUVD-2025-211091
GHSA-p2j4-rcc2-w382
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged user account
-
ExploitSend crafted request to Qsync Central
-
ExecutionTrigger NULL pointer dereference
-
ImpactCrash service (denial of service)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to first obtain a valid low-privileged user account on the QNAP NAS running Qsync Central (CVSS PR:L), so this is authenticated, not anonymous. The CVSS 4.0 vector also sets AT:P, indicating an additional attack requirement/precondition must be present for the NULL pointer dereference to be reached, though the vendor does not specify it. Limiting factors: authentication is mandatory, the impact is confined to availability (service crash/DoS - no read or write of data), and affected systems are only those running Qsync Central prior to version 5.0.0.4. Patched instances (5.0.0.4+) are not exploitable. |
| Impact | This is a genuinely low-priority issue, and the signals are internally consistent rather than conflicting. The vendor-supplied CVSS 4.0 score is 0.6 (Low), with a vector of AV:N/AC:L/AT:P/PR:L/UI:N and only a limited availability impact (VA:L); confidentiality and integrity are explicitly unaffected (VC:N/VI:N). The exploitation maturity metric is E:U (unproven), aligning with the absence of any POC or KEV listing. No EPSS score was provided in the input, so exploitation probability cannot be quantified, but the combination of required authentication (PR:L - a valid user account), an additional attack requirement (AT:P), and an impact limited to a crash/DoS with no data exposure makes this a classic high-visibility-but-low-real-risk finding. There is no SSVC decision data in the input. The one mild caveat: the CVSS vector lists AV:N (network) while the description says the attacker must first 'gain a user account,' which is consistent with PR:L but means this is not an anonymous remote attack - the network vector applies only to already-authenticated users. |
| Exploit ScenarioDerived | An attacker who already holds a low-privileged user account on a QNAP NAS running Qsync Central sends a crafted request that triggers a NULL pointer dereference (CWE-476), crashing the service and causing a denial of service. No public exploit code has been identified, and the AT:P requirement means a specific precondition must be met for the crash to occur. The impact is limited to service availability - no data is read or modified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
Denial of service in QNAP Qsync Central before 5.0.0.4 can be triggered by an authenticated low-privileged user who reaches a NULL pointer dereference in the service. The vendor has fixed the issue in Qsync Central 5.0.0.4 and later, no public exploit identified at time of analysis, and the independent assessment rates this as a genuinely low-priority, availability-only issue.
RemediationAI
Vendor-released patch: Qsync Central 5.0.0.4 and later. Upgrade through QNAP App Center or the QNAP release-notes page at https://www.qnap.com/en/app-release-notes?keyword=Qsync%20&app=QsyncServer&product-line=nas. If immediate patching is not possible, disable Qsync Central when it is not required, restrict access to the Qsync service and NAS management interfaces to trusted networks, and minimize the number of low-privileged NAS accounts that can access Qsync; these measures reduce exposure but will disrupt synchronization workflows and may affect legitimate collaboration. No public exploit was identified at time of analysis, so broad emergency measures are not proportionate.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Qsync Central is a QNAP NAS file-synchronization application, and CVE-2025-29896 is a CWE-476 NULL pointer dereference, a programming flaw in which code dereferences a null pointer, typically resulting in a process crash or service outage rather than code execution or data compromise. The independent CVSS 3.1 assessment is AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L, and the vendor-supplied CVSS 4.0 vector is AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N; both indicate a network-reachable, authenticated, availability-only condition. CVSS 4.0 AT:P denotes an additional attack precondition that the vendor does not describe in the provided data, and no CPE identifiers were included in the supplied intelligence, so product identification relies on the vendor advisory naming Qsync Central on QNAP NAS.
Know when Qnap gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Authenticated user needed (PR:L); the AT:P precondition maps to AC:H in 3.1; only a service crash, so A:L with C:N/I:N.
Primary rating from Vendor (qnapsecurity).
CVSS VectorVendor: qnapsecurity
Lifecycle Timeline
2DescriptionCVE.org
A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.
We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 and later
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
QNAP QTS before 4.2.4 Build 20170313 allows attackers to execute arbitrary commands via unspecified vectors. Rated criti
QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and obtain sensitive information
QNAP has patched a remote code execution vulnerability affecting the QTS Media Library in all versions prior to QTS 4.2.
QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and execute arbitrary commands vi
Exposure of Private Information in QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticate
QNAP QTS before 4.2.4 Build 20170313 allows local users to obtain sensitive Domain Administrator password information by
This command injection vulnerability in QTS allows attackers to run arbitrary commands in the compromised application. R
Command injection vulnerability in change password of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could
An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. Rated cr
This external control of file name or path vulnerability allows remote attackers to access or modify system files. Rated
Exploit-DB