Vulnerability

CERT-In Vulnerability Note CIVN-2025-0120
Multiple Vulnerabilities in Qsync Central

Original Issue Date:June 11, 2025

Severity Rating: HIGH

Software Affected

Qsync Central 4.5.x

Overview

Multiple vulnerabilities have been reported in Qsync Central which could allow a remote authenticated attacker to obtain sensitive information and execute arbitrary code on the targeted system.

Target Audience:
All end-user organizations and individuals using Qsync Central.

Impact Assessment:
Potential to gain unauthorized access and arbitrary code execution.

Description

Qsync Central is a cloud-based file synchronization service on Network-Attached Storage (NAS).

Multiple vulnerabilities exists in Qsync Central due to use of externally-controlled format string and SQL injection. A remote authenticated attacker could exploit these vulnerabilities by sending a specially crafted request.

Successful exploitation of these vulnerabilities could allow an attacker to obtain sensitive information and execute arbitrary code on the targeted system.

Solution

Apply appropriate updates as mentioned by the vendor
https://www.qnap.com/en/security-advisory/qsa-25-10

Vendor Information

Qsync Central
https://www.qnap.com/en/security-advisory/qsa-25-10

References

Qsync Central
https://www.qnap.com/en/security-advisory/qsa-25-10

CVE Name
CVE-2025-22482
CVE-2025-29892

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-22902657

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India