CVE-2024-53694— QVPN Device Client, Qsync, Qfinder Pro
Quick assessment
Affected
QNAP Systems Inc. QVPN Device Client for Mac
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
QNAP Systems QVPN Device Client等都是中国威联通科技（QNAP Systems）公司的产品。QVPN Device Client是一款客户端软件，用于管理与 QNAP 设备上运行的 VPN 服务器的连接。QNAP Systems Qfinder Pro是一款实用程序，可在同一网络下快速搜索和管理 NAS。QNAP Systems Qsync是一种文件同步服务，用于在 NAS 和其他设备之间同步文件和文件夹。 QVPN Device Client 2.2.5之前版本、QNAP
Possible ATT&CK Techniques 2 AI
T1068 · Exploitation for Privilege Escalation T1564.004 · NTFS File Attributes
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2024-53694
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
QVPN Device Client, Qsync, Qfinder Pro
Source: CVE Program / CVE List V5
Vulnerability Description
A time-of-check time-of-use (TOCTOU) race condition vulnerability has been reported to affect several product versions. If exploited, the vulnerability could allow local attackers who have gained user access to gain access to otherwise unauthorized resources.
We have already fixed the vulnerability in the following versions:
QVPN Device Client for Mac 2.2.5 and later
Qsync for Mac 5.1.3 and later
Qfinder Pro Mac 7.11.1 and later
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Source: CVE Program / CVE List V5
Vulnerability Type
检查时间与使用时间(TOCTOU)的竞争条件
Source: CVE Program / CVE List V5
Vulnerability Title
QVPN Device Client、QNAP Systems Qsync和QNAP Systems Qfinder Pro 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
QNAP Systems QVPN Device Client等都是中国威联通科技（QNAP Systems）公司的产品。QVPN Device Client是一款客户端软件，用于管理与 QNAP 设备上运行的 VPN 服务器的连接。QNAP Systems Qfinder Pro是一款实用程序，可在同一网络下快速搜索和管理 NAS。QNAP Systems Qsync是一种文件同步服务，用于在 NAS 和其他设备之间同步文件和文件夹。 QVPN Device Client 2.2.5之前版本、QNAP
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| QNAP Systems Inc. | QVPN Device Client for Mac | 2.2.x ~ 2.2.5 | - |
|
| QNAP Systems Inc. | Qsync for Mac | 5.1.x ~ 5.1.3 | - |
|
| QNAP Systems Inc. | Qfinder Pro Mac | 7.11.x ~ 7.11.1 | - |
|
II. Public POCs for CVE-2024-53694
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-53694
请登录查看更多情报信息。
Vendor Advisories for CVE-2024-53694 (1)
Same Patch Batch · QNAP Systems Inc. · 2025-03-07 · 15 CVEs total
| CVE-2024-13086 | 5.3 MEDIUM | QTS, QuTS hero |
| CVE-2024-38638 | QTS, QuTS hero | |
| CVE-2024-48864 | File Station 5 | |
| CVE-2024-50390 | QHora | |
| CVE-2024-50394 | Helpdesk | |
| CVE-2024-50405 | QTS, QuTS hero | |
| CVE-2024-53692 | QTS, QuTS hero | |
| CVE-2024-53693 | QTS, QuTS hero | |
| CVE-2024-53695 | HBS 3 Hybrid Backup Sync | |
| CVE-2024-53696 | QuLog Center | |
| CVE-2024-53697 | QTS, QuTS hero | |
| CVE-2024-53698 | QTS, QuTS hero | |
| CVE-2024-53699 | QTS, QuTS hero | |
| CVE-2024-53700 | QHora |
IV. Related Vulnerabilities
Same weakness: CWE-367
V. Comments for CVE-2024-53694
No comments yet