PT-2025-24305 · Unknown · Qsync Central

Coral · Published 2025-06-06 · Updated 2025-06-10 · CVE-2025-29892

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Qsync Central versions prior to 4.5.0.6

Description An SQL injection vulnerability has been reported to affect Qsync Central. If exploited, this issue could allow remote attackers who have gained user access to execute unauthorized code or commands.

Recommendations For versions prior to 4.5.0.6, update to Qsync Central version 4.5.0.6 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive areas of Qsync Central to minimize the risk of exploitation.

Fix

RCE

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2025-06748

CVE-2025-29892

Affected Products

Qsync Central

References · 9

• https://osv.dev/vulnerability/CVE-2025-29892 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-06748 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-29892 · Security Note
• https://twitter.com/CCBalert/status/1932444878685843718 · Twitter Post
• https://twitter.com/CveFindCom/status/1931020806819094836 · Twitter Post
• https://qnap.com/en/security-advisory/qsa-25-10 · Note
• https://twitter.com/VulmonFeeds/status/1931170909059961309 · Twitter Post
• https://twitter.com/CVEnew/status/1931037245630275901 · Twitter Post
• https://t.me/cvetracker/25646 · Telegram Post