CVE-2025-29897: Stack-based Buffer Overflow in qsyncsrv.cgi
Published Oct 15, 2026
·Updated
A buffer copy without checking size of input vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes.
We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 and later
Affected Software
1 affected component
QNAP Qsync Central<5.0.0.4
Event History
Oct 15, 2026
CVE Published
via MITRE·06:57 AM
Data Sourced
via MITRE·06:57 AM
RemedyDescriptionWeakness
Frequently Asked Questions
1
Who can exploit this issue?
A remote attacker must first gain a user account. The provided information does not indicate that unauthenticated attackers can exploit it.
2
Which deployments need to be updated?
Qsync Central versions earlier than 5.0.0.4 are affected. Qsync Central 5.0.0.4 and later include the fix.
3
What is the potential impact after exploitation?
An authenticated remote attacker can modify memory or crash processes.