CVE-2025-52867
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
An uncontrolled resource consumption vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.
Risk Assessment
An attacker can exhaust system resources, causing the Qsync Central service to become unavailable to legitimate users.
Recommendation
Update Qsync Central to version 5.0.0.2 or later.
Other vulnerabilities in Qsync Central
See all- CVE-2026-41541Medium
An unix symbolic link (symlink) following vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. The vulnerability has been fixed in versions 5.0.0.7, 5.1.0.3, 5.2.0.5, and 5.3.0.2 and later.
- CVE-2026-26243High
A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.
- CVE-2026-24718Medium
A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.
- CVE-2025-29897Low
A buffer copy without checking size of input vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes.
- CVE-2025-29896Low
A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.
- CVE-2025-29895Low
A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.
- CVE-2025-57712Medium
A path traversal vulnerability has been reported in Qsync Central. A remote attacker with a user account can exploit it to read unexpected files or system data.
- CVE-2025-54153High
An SQL injection vulnerability has been reported to affect Qsync Central. A remote attacker who gains a user account can exploit the vulnerability to execute unauthorized code or commands.
- CVE-2025-53595High
An SQL injection vulnerability has been reported to affect Qsync Central. A remote attacker who gains a user account can exploit the vulnerability to execute unauthorized code or commands.
- CVE-2025-47210Medium
A NULL pointer dereference vulnerability in Qsync Central allows a remote attacker with a user account to launch a denial-of-service (DoS) attack.
Original NVD description (English source)
An uncontrolled resource consumption vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.2 ( 2025/07/31 ) and later
Vulnerability data from NVD (NIST) · CISA KEV · EPSS