CVE-2025-29895

A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 and later

CVSS

No CVSS.

References

Link	Resource
https://www.qnap.com/en/app-release-notes?keyword=Qsync%20&app=QsyncServer&product-line=nas

Configurations

No configuration.

History

19 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Se ha reportado una vulnerabilidad de desreferenciación de puntero nulo que afecta a Qsync Central. Si un atacante remoto obtiene una cuenta de usuario, puede entonces exploit la vulnerabilidad para lanzar un ataque de denegación de servicio (DoS).\n\nYa hemos corregido la vulnerabilidad en la siguiente versión: Qsync Central a partir de la versión 5.0.0.4.

15 Oct 2026, 07:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-15 07:17

Updated : 2026-10-19 22:10

NVD link : CVE-2025-29895

Mitre link : CVE-2025-29895

CVE.ORG link : CVE-2025-29895

JSON object : View

Products Affected

No product.

CWE

CWE-476

NULL Pointer Dereference

{"id": "CVE-2025-29895", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-29895", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-15T14:52:28.744754Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security@qnapsecurity.com.tw", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security@qnapsecurity.com.tw", "affectedData": [{"vendor": "QNAP Systems Inc.", "product": "Qsync Central", "versions": [{"status": "affected", "version": "5.0.x", "lessThan": "5.0.0.4", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-10-15T07:17:55.803", "references": [{"url": "https://www.qnap.com/en/app-release-notes?keyword=Qsync%20&app=QsyncServer&product-line=nas", "source": "security@qnapsecurity.com.tw"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security@qnapsecurity.com.tw", "description": [{"lang": "en", "value": "CWE-476"}]}], "descriptions": [{"lang": "en", "value": "A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.\n\nWe have already fixed the vulnerability in the following version:\nQsync Central 5.0.0.4 and later"}, {"lang": "es", "value": "Se ha reportado una vulnerabilidad de desreferenciaci\u00f3n de puntero nulo que afecta a Qsync Central. Si un atacante remoto obtiene una cuenta de usuario, puede entonces exploit la vulnerabilidad para lanzar un ataque de denegaci\u00f3n de servicio (DoS).\\n\\nYa hemos corregido la vulnerabilidad en la siguiente versi\u00f3n: Qsync Central a partir de la versi\u00f3n 5.0.0.4."}], "lastModified": "2026-10-19T22:10:00.130", "sourceIdentifier": "security@qnapsecurity.com.tw"}