An incorrect permission assignment for critical resource vulnerability has been reported to affect Qsync Central. If exploited, the vulnerability could allow authenticated users to read or modify the resource via a network. We have already fixed the vulnerability in the following versions: Qsync Central 4.4.0.15 ( 2024/01/04 ) and later Qsync Central 4.3.0.11 ( 2024/01/11 ) and later
Solution:
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
| Link | Tags |
|---|---|
| https://www.qnap.com/en/security-advisory/qsa-24-03 | vendor advisory |