CVE-2025-29895: NULL Pointer Dereference in qsyncsrv.cgi

Q: What access does an attacker need to exploit this issue?

The attacker must first obtain a user account. The issue can then be exploited remotely to cause a denial of service.

Q: Which versions are fixed?

Qsync Central 5.0.0.4 and later contain the fix.

Published Oct 15, 2026

Updated

A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 and later

Affected Software

1 affected component

QNAP Qsync Central<5.0.0.4

Event History

Oct 15, 2026

CVE Published

via MITRE·06:57 AM

Data Sourced

via MITRE·06:57 AM

RemedyDescriptionWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The attacker must first obtain a user account. The issue can then be exploited remotely to cause a denial of service.

Which versions are fixed?

Qsync Central 5.0.0.4 and later contain the fix.