Ce mail provient de l'extérieur, restons vigilants

=====================================================================

                            CERT-Renater

                Note d'Information No. 2025/VULN569
_____________________________________________________________________

DATE                : 02/09/2025

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Qsync Central versions prior to
                            4.5.0.7 (2025/04/23).

=====================================================================
https://www.qnap.com/en/security-advisory/qsa-25-22
_____________________________________________________________________


Security ID : QSA-25-22
Multiple Vulnerabilities in Qsync Central

    Release date : August 29, 2025

    CVE identifier : CVE-2025-29893 | CVE-2025-29894 | CVE-2025-29898
| CVE-2025-30260 | CVE-2025-30275 | CVE-2025-30277 | CVE-2025-30278
| CVE-2025-33033 | CVE-2025-33036 | CVE-2025-33037 | CVE-2025-33038

    Affected products: Qsync Central 4.5.x

Severity
Important

Status
Resolved


Summary

Multiple vulnerabilities have been reported to affect Qsync Central:

    CVE-2025-29893, CVE-2025-29894: If a remote attacker gains access
to a user account, they can then exploit the SQL injection
vulnerabilities to execute unauthorized code or commands.

    CVE-2025-29898: If a remote attacker gains access to a user account,
they can then exploit the uncontrolled resource consumption
vulnerability to launch a denial-of-service (DoS) attack.

    CVE-2025-30260: If a remote attacker gains access to a user account,
they can then exploit the allocation of resources without limits or
throttling vulnerability to prevent other systems, applications, or
processes from accessing the same type of resource.

    CVE-2025-30275: If a remote attacker gains access to a user account,
they can then exploit the NULL pointer dereference vulnerability to
launch a denial-of-service (DoS) attack.

    CVE-2025-30277, CVE-2025-30278: If a remote attacker gains access
to a user account, they can then exploit the improper certificate
validation vulnerabilities to compromise the security of the system.

    CVE-2025-33033, CVE-2025-33036, CVE-2025-33037, CVE-2025-33038:
If a remote attacker gains access to a user account, they can then
exploit the path traversal vulnerabilities to read the contents of
unexpected files or system data.


We have already fixed the vulnerabilities in the following version:

Affected Product 	Fixed Version
Qsync Central 4.5.x 	Qsync Central 4.5.0.7 (2025/04/23) and later


Recommendation

To fix the vulnerabilities, we recommend updating Qsync Central
to the latest version.


Updating Qsync Central

    Log on to QTS or QuTS hero as an administrator.
    Open App Center and then click .
    A search box appears.
    Type "Qsync Central" and then press ENTER.
    Qsync Central appears in the search results.
    Click Update.
    A confirmation message appears.
    Note: The Update button is not available if your Qsync
Central is already up to date.
    Click OK.
    The system updates the application.

  

Attachment

    CVE-2025-29893.json
    CVE-2025-29894.json
    CVE-2025-29898.json
    CVE-2025-30260.json
    CVE-2025-30275.json
    CVE-2025-30277.json
    CVE-2025-30278.json
    CVE-2025-33033.json
    CVE-2025-33036.json
    CVE-2025-33037.json
    CVE-2025-33038.json

Acknowledgements: coral, Searat and izut

Revision History:
V1.0 (August 29, 2025) - Published


=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================