Description
A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following version:
Qsync Central 5.0.0.4 and later
Published: 2026-10-15
Score: 2.3 Low
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Patch Now
AI Analysis

Impact

A null pointer dereference in Qsync Central can cause the web service to crash, resulting in a denial‑of‑service condition where users are unable to access the service until it is restarted.

Affected Systems

The vulnerability affects QNAP Systems Inc. Qsync Central before version 5.0.0.4. Any installation of Qsync Central prior to the fixed release is potentially impacted.

Risk and Exploitability

The CVSS score of 2.3 indicates low severity. The EPSS score of under 1% suggests a very low probability of exploitation, and the vulnerability is not listed in CISA's KEV catalog. Based on the advisory, a remote attacker must first obtain a valid user account; from that position, the attacker can trigger the null pointer dereference to launch a DoS attack.

Generated by OpenCVE AI on October 16, 2026 at 22:41 UTC.

Remediation

Vendor Solution

We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 and later

OpenCVE Recommended Actions

  • Upgrade Qsync Central to version 5.0.0.4 or later.
  • Limit user accounts to trusted individuals and require strong authentication methods.
  • Monitor Qsync Central logs for repeated failure patterns or abnormal request traffic, and temporarily disable the affected service if a DoS condition is observed.

Generated by OpenCVE AI on October 16, 2026 at 22:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 16 Oct 2026 20:45:00 +0000

Type Values Removed Values Added
First Time appeared Qnap Systems
Qnap Systems qsync Central
Vendors & Products Qnap Systems
Qnap Systems qsync Central

Thu, 15 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 15 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics cvssV4_0

{'score': 0.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U'}

 cvssV4_0

{'score': 2.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}

Thu, 15 Oct 2026 07:00:00 +0000

Type Values Removed Values Added
Description A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 and later
Title NULL Pointer Dereference in qsyncsrv.cgi
Weaknesses CWE-476
References
Metrics cvssV4_0

{'score': 0.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U'}

Subscriptions

Qnap Systems Qsync Central
cve-icon MITRE

Status: PUBLISHED

Assigner: qnap

Published:

Updated: 2026-10-15T14:52:35.865Z

Reserved: 2025-03-12T08:51:05.986Z

Link: CVE-2025-29895

cve-icon Vulnrichment

Updated: 2026-10-15T14:52:32.305Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-15T07:17:55.803

Modified: 2026-10-19T22:10:00.130

Link: CVE-2025-29895

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-16T22:45:14Z

Weaknesses