Qsync Central Externally-Controlled Format String Vulnerability

A use of externally-controlled format string vulnerability has been reported in Qsync Central versions 4.5.x. This vulnerability allows remote attackers with user access to obtain secret data or modify memory. The issue has been fixed in Qsync Central version 4.5.0.6 (released on March 20, 2025) and later.

Impact

Exploitation of this vulnerability could lead to unauthorized access to secret data or unauthorized modification of memory.

Remediation

To address this vulnerability, users should update Qsync Central to the latest version. Instructions for updating Qsync Central are available in the QNAP security advisory QSA-25-10.