CVE-2024-50404
Published: 06 December 2024
Summary
CVE-2024-50404 is a medium-severity Link Following (CWE-59) vulnerability in Qnap Qsync Central. Its CVSS base score is 6.8 (Medium).
Operationally, ranked in the top 2.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2024-50404 is a link following vulnerability, tracked as CWE-59, that affects Qsync Central. The flaw resides in the software's handling of file paths and can be triggered over the network by an authenticated user, resulting in traversal to unintended file system locations with a CVSS 4.0 score of 6.8.
Attackers who have already obtained valid user credentials can exploit the issue remotely to access resources outside the intended scope. The vulnerability does not require user interaction beyond the initial access and primarily threatens availability, though the precise data exposure or modification outcomes depend on the traversed paths.
QNAP has released a fix in Qsync Central 4.4.0.16_20240819 and later versions, as documented in security advisory QSA-24-48. Organizations should apply the patched release promptly to eliminate the path traversal vector.
The associated EPSS score has remained flat at 0.4429 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-45189
Vulnerability details
A link following vulnerability has been reported to affect Qsync Central. If exploited, the vulnerability could allow remote attackers who have gained user access to traverse the file system to unintended locations. We have already fixed the vulnerability in the…
more
following versions: Qsync Central 4.4.0.16_20240819 ( 2024/08/19 ) and later
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.