CVE-2025-29896: NULL Pointer Dereference in qsyncsrv.cgi
Published Oct 15, 2026
·Updated
A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.
We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 and later
Affected Software
1 affected component
QNAP Qsync Central<5.0.0.4
Event History
Oct 15, 2026
CVE Published
via MITRE·06:57 AM
Data Sourced
via MITRE·06:57 AM
RemedyDescriptionWeakness
Frequently Asked Questions
1
Who can exploit this issue?
A remote attacker must first obtain a user account. The reported impact is denial of service against Qsync Central.
2
Which versions are fixed?
Qsync Central 5.0.0.4 and later contain the fix.