PT-2025-40546 · Qnap · Qsync Central

Coral · Published 2025-10-03 · Updated 2025-10-07 · CVE-2025-33040

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Qsync Central versions prior to 5.0.0.1

Description A flaw exists in Qsync Central where unrestricted resource allocation can occur. A remote attacker who obtains a user account may be able to prevent other systems, applications, or processes from accessing the same resource.

Recommendations Update to Qsync Central version 5.0.0.1 or later.

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2025-33040

Affected Products

Qsync Central

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-33040 · Security Note
• https://osv.dev/vulnerability/CVE-2025-33040 · Vendor Advisory
• https://qnap.com/en/security-advisory/qsa-25-34 · Vendor Advisory
• https://t.me/cveNotify/137670 · Telegram Post
• https://t.me/CVEtracker/34042 · Telegram Post
• https://twitter.com/CVEnew/status/1974177855606075462 · Twitter Post