What’s Vulnerable › Vulnerabilities

CVE-2024-53694: QVPN Device Client, Qsync, Qfinder Pro

• Severity: high (CVSS 8.6 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-03-07 · updated 2026-06-17
• Weakness: CWE-367

Description

A time-of-check time-of-use (TOCTOU) race condition vulnerability has been reported to affect several product versions. If exploited, the vulnerability could allow local attackers who have gained user access to gain access to otherwise unauthorized resources. We have already fixed the vulnerability in the following versions: QVPN Device Client for Mac 2.2.5 and later Qsync for Mac 5.1.3 and later Qfinder Pro Mac 7.11.1 and later

Affected products

• QNAP Systems Inc. Qfinder Pro Mac: from 7.11.x before 7.11.1 — fixed in 7.11.1
• QNAP Systems Inc. Qsync for Mac: from 5.1.x before 5.1.3 — fixed in 5.1.3
• QNAP Systems Inc. QVPN Device Client for Mac: from 2.2.x before 2.2.5 — fixed in 2.2.5

How to fix

Upgrade to a fixed version: QNAP Systems Inc. Qfinder Pro Mac 7.11.1; QNAP Systems Inc. Qsync for Mac 5.1.3; QNAP Systems Inc. QVPN Device Client for Mac 2.2.5. Check the vendor advisory for mitigations.

References

• https://www.qnap.com/en/security-advisory/qsa-24-51

Get alerted when CVE-2024-53694 or the next vulnerability affects your stack