CVE-2025-29896— NULL Pointer Dereference in qsyncsrv.cgi
Quick assessment
Affected
QNAP Systems Inc. Qsync Central
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
已报告存在一个空指针解引用漏洞，影响 Qsync Central。如果远程攻击者获取了用户账户权限，便可以利用该漏洞发起拒绝服务（DoS）攻击。 我们已在以下版本中修复了该漏洞： Qsync Central 5.0.0.4 及更高版本
Possible ATT&CK Techniques 1 AI
T1499 · Endpoint Denial of ServiceAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| QNAP Systems Inc. | Qsync Central | 5.0.x< 5.0.0.4 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-29896
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
NULL Pointer Dereference in qsyncsrv.cgi
Source: CVE Program / CVE List V5
Vulnerability Description
A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.
We have already fixed the vulnerability in the following version:
Qsync Central 5.0.0.4 and later
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
空指针解引用
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| QNAP Systems Inc. | Qsync Central | 5.0.x ~ 5.0.0.4 | - |
|
II. Public POCs for CVE-2025-29896
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-29896
请登录查看更多情报信息。
Other References for CVE-2025-29896 (1)
Same Patch Batch · QNAP Systems Inc. · 2026-10-15 · 35 CVEs total
| CVE-2026-50612 | 9.4 CRITICAL | Import Symlink Following Remote Code Execution Vulnerability in QuMagie |
| CVE-2026-50619 | 9.3 CRITICAL | Unauthenticated remote code execution vulnerability |
| CVE-2026-47786 | 9.3 CRITICAL | Pre-Authentication Command Injection |
| CVE-2026-34006 | 9.3 CRITICAL | Pre-Authentication Multiple Critical Vulnerabilities in QNAP sMedioDTCPServer |
| CVE-2026-39997 | 8.9 HIGH | Unauthenticated Remote Input Injection in QNAP HD Station's remotepad |
| CVE-2026-39993 | 8.7 HIGH | Path Traversal to Root RCE in QNAP Download Station via Addon/Search addon Parameter |
| CVE-2026-41544 | 8.7 HIGH | Path Traversal leading to Arbitrary File Move, Docker Escape, and Host RCE in /calapi/rena |
| CVE-2026-34015 | 8.7 HIGH | Remote Code Execution in upload.php of Video Station |
| CVE-2026-44084 | 8.7 HIGH | Access Code Forgery in Video Station leading to unauthorized media access |
| CVE-2026-53882 | 8.7 HIGH | Path Traversal in Virtualization Station VM Import |
| CVE-2026-41545 | 8.6 HIGH | WebSocket timelapse path traversal and command injection |
| CVE-2026-34008 | 8.5 HIGH | **Privilege Escalation** World-writable crontab path monitored and executed by root-owned |
| CVE-2026-34014 | 8.4 HIGH | ds-move-files.sh is writable and executed as root |
| CVE-2026-34009 | 8.4 HIGH | **Container Escape** Host user home directory mounted with write access into application c |
| CVE-2025-66275 | 7.7 HIGH | Remote code execution via command injection |
| CVE-2025-66272 | 7.7 HIGH | Arbitrary file deletion and remote code execution |
| CVE-2025-68404 | 7.5 HIGH | vcs_pentest Race Condition Authentication Bypass Vulnerability in QuRouter management inte |
| CVE-2026-26243 | 7.2 HIGH | Arbitrary Folder Deletion in Qsync Central 5.0.0.5 |
| CVE-2026-26245 | 7.1 HIGH | SQLi#2 SQL Injection in class_videos.php getSmartVideosByOffset |
| CVE-2026-26244 | 7.1 HIGH | SQLi#1 SQL Injection in class_videos.php _getFilters |
Showing top 20 of 35 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Qsync Central
-
CVE-2026-41541
Symlink creation in qsyncsrv.cgi -
CVE-2026-26243
Arbitrary Folder Deletion in Qsync Central 5.0.0.5 -
CVE-2026-24718
Path Traversal Vulnerability in Qsync Central's qsyncsrv.cgi -
CVE-2025-29897
Stack-based Buffer Overflow in qsyncsrv.cgi -
CVE-2025-29895
NULL Pointer Dereference in qsyncsrv.cgi
Same vendor: QNAP Systems Inc.
-
CVE-2026-50619
Unauthenticated remote code execution vulnerability -
CVE-2026-47790
Privilege Escalation via QuFTP Log-based XSS -
CVE-2026-47786
Pre-Authentication Command Injection -
CVE-2026-39997
Unauthenticated Remote Input Injection in QNAP HD Station's -
CVE-2026-39991
Stored Cross-Site Scripting (XSS) in Note Station file uploa
Same weakness: CWE-476
-
CVE-2026-111144
libansilove 1.3.0 through 1.4.2 NULL Pointer Dereference via -
CVE-2026-111129
Assimp through 6.0.5 NULL Pointer Dereference via Ogre Anima -
CVE-2026-111128
Assimp through 6.0.5 NULL Pointer Dereference via Ogre Impor -
CVE-2026-100353
kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three U -
CVE-2026-100349
kin-openapi openapi3filter: nil-pointer panic in ValidateRes
V. Comments for CVE-2025-29896
No comments yet