CVE-2025-29897— Stack-based Buffer Overflow in qsyncsrv.cgi
Quick assessment
Affected
QNAP Systems Inc. Qsync Central
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
据报道，Qsync Central 存在一个输入数据大小未经验证的缓冲区复制漏洞。如果远程攻击者获取了用户账户权限，便可利用此漏洞修改内存或导致进程崩溃。 我们已在以下版本中修复了该漏洞： Qsync Central 5.0.0.4 及更高版本
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| QNAP Systems Inc. | Qsync Central | 5.0.x< 5.0.0.4 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-29897
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Stack-based Buffer Overflow in qsyncsrv.cgi
Source: CVE Program / CVE List V5
Vulnerability Description
A buffer copy without checking size of input vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes.
We have already fixed the vulnerability in the following version:
Qsync Central 5.0.0.4 and later
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
未进行输入大小检查的缓冲区拷贝(传统缓冲区溢出)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| QNAP Systems Inc. | Qsync Central | 5.0.x ~ 5.0.0.4 | - |
|
II. Public POCs for CVE-2025-29897
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-29897
请登录查看更多情报信息。
Other References for CVE-2025-29897 (1)
Same Patch Batch · QNAP Systems Inc. · 2026-10-15 · 35 CVEs total
| CVE-2026-50612 | 9.4 CRITICAL | Import Symlink Following Remote Code Execution Vulnerability in QuMagie |
| CVE-2026-34006 | 9.3 CRITICAL | Pre-Authentication Multiple Critical Vulnerabilities in QNAP sMedioDTCPServer |
| CVE-2026-50619 | 9.3 CRITICAL | Unauthenticated remote code execution vulnerability |
| CVE-2026-47786 | 9.3 CRITICAL | Pre-Authentication Command Injection |
| CVE-2026-39997 | 8.9 HIGH | Unauthenticated Remote Input Injection in QNAP HD Station's remotepad |
| CVE-2026-39993 | 8.7 HIGH | Path Traversal to Root RCE in QNAP Download Station via Addon/Search addon Parameter |
| CVE-2026-34015 | 8.7 HIGH | Remote Code Execution in upload.php of Video Station |
| CVE-2026-44084 | 8.7 HIGH | Access Code Forgery in Video Station leading to unauthorized media access |
| CVE-2026-53882 | 8.7 HIGH | Path Traversal in Virtualization Station VM Import |
| CVE-2026-41544 | 8.7 HIGH | Path Traversal leading to Arbitrary File Move, Docker Escape, and Host RCE in /calapi/rena |
| CVE-2026-41545 | 8.6 HIGH | WebSocket timelapse path traversal and command injection |
| CVE-2026-34008 | 8.5 HIGH | **Privilege Escalation** World-writable crontab path monitored and executed by root-owned |
| CVE-2026-34014 | 8.4 HIGH | ds-move-files.sh is writable and executed as root |
| CVE-2026-34009 | 8.4 HIGH | **Container Escape** Host user home directory mounted with write access into application c |
| CVE-2025-66275 | 7.7 HIGH | Remote code execution via command injection |
| CVE-2025-66272 | 7.7 HIGH | Arbitrary file deletion and remote code execution |
| CVE-2025-68404 | 7.5 HIGH | vcs_pentest Race Condition Authentication Bypass Vulnerability in QuRouter management inte |
| CVE-2026-26243 | 7.2 HIGH | Arbitrary Folder Deletion in Qsync Central 5.0.0.5 |
| CVE-2026-26244 | 7.1 HIGH | SQLi#1 SQL Injection in class_videos.php _getFilters |
| CVE-2026-26245 | 7.1 HIGH | SQLi#2 SQL Injection in class_videos.php getSmartVideosByOffset |
Showing top 20 of 35 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Qsync Central
-
CVE-2026-41541
Symlink creation in qsyncsrv.cgi -
CVE-2026-26243
Arbitrary Folder Deletion in Qsync Central 5.0.0.5 -
CVE-2026-24718
Path Traversal Vulnerability in Qsync Central's qsyncsrv.cgi -
CVE-2025-29896
NULL Pointer Dereference in qsyncsrv.cgi -
CVE-2025-29895
NULL Pointer Dereference in qsyncsrv.cgi
Same vendor: QNAP Systems Inc.
-
CVE-2026-50619
Unauthenticated remote code execution vulnerability -
CVE-2026-47790
Privilege Escalation via QuFTP Log-based XSS -
CVE-2026-47786
Pre-Authentication Command Injection -
CVE-2026-39997
Unauthenticated Remote Input Injection in QNAP HD Station's -
CVE-2026-39991
Stored Cross-Site Scripting (XSS) in Note Station file uploa
Same weakness: CWE-120
-
CVE-2026-102693
RIOT: Remote Stack Buffer Overflow in ATWINC15x0 driver via -
CVE-2026-0993
SODOLA SL902-SWTGW124AS Buffer Overflow DoS via Multipart Bo -
CVE-2026-110695
turboderp ExLlamaV2 Safetensors Tensor Loader stloader.py ST -
CVE-2026-102176
Junos OS: Specific packets cause SDK service crash or Routin -
CVE-2016-15060
PCMan FTP Server PORT buffer overflow
V. Comments for CVE-2025-29897
No comments yet