QNAP Qsync Central 4.x Multiple Vulnerabilities Advisory (Path Traversal, DoS, OOB Write)

Key Information Security ID: QSA-25-34 Release Date: October 4, 2025 CVE Identifiers: - CVE-2025-33034 - CVE-2025-33039 - CVE-2025-33040 - CVE-2025-44006 - CVE-2025-44007 - CVE-2025-44008 - CVE-2025-44009 - CVE-2025-44010 - CVE-2025-44011 - CVE-2025-44014 Affected Product: Qsync Central 4.x Severity: Medium Status: Resolved Vulnerability Summary CVE-2025-33034: Path traversal vulnerability. A remote attacker, after gaining access to a user account, can exploit this vulnerability to read the contents of unintended files or system data. CVE-2025-33039, CVE-2025-33040, CVE-2025-44006, CVE-2025-44007: Unrestricted or unthrottled resource allocation vulnerabilities. A remote attacker, after gaining access to a user account, can exploit these vulnerabilities to prevent other systems, applications, or processes from accessing the same type of resources. CVE-2025-44008, CVE-2025-44009, CVE-2025-44010, CVE-2025-44011: NULL pointer dereference vulnerabilities. A remote attacker, after gaining access to a user account, can exploit these vulnerabilities to launch a Denial of Service (DoS) attack. CVE-2025-44014: Out-of-bounds write vulnerability. A remote attacker, after gaining access to a user account, can exploit this vulnerability to modify or corrupt memory. Fixed Versions Recommended Actions It is recommended to update Qsync Central to the latest version to fix the vulnerabilities. Update Instructions 1. Log in to QTS or QuTS hero as an administrator. 2. Open App Center and click on Q. 3. Type “Qsync Central” and press ENTER. 4. Click Update. 5. Click OK to complete the update.

Goal Reached Thanks to every supporter — we hit 100%!

QNAP Qsync Central 4.x Multiple Vulnerabilities Advisory (Path Traversal, DoS, OOB Write)