What is CVE-2025-29892?

CVE-2025-29892 is a high-severity vulnerability in Qnap Qsync_central, classified under SQL Injection. CVSS score: 8.8/10. Published 2025-06-06.

How severe is CVE-2025-29892?

High severity. CVSS v3 base score is 8.8 out of 10.

SQL Injection in Qnap Qsync_central

CVE-2025-29892

An SQL injection vulnerability has been reported to affect Qsync Central. If exploited, the vulnerability could allow remote attackers who have gained user access to execute unauthorized code or commands. We have already fixed the vulnera…

Vulnerability class: SQL Injection

EPSS: 0.004 (30.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Qnap Qsync_central
Qnap Systems Inc. Qsync Central — versions 4.5.x.x

Weakness classification (CWE)

CWE-89 — SQL Injection

References

security@qnapsecurity.com.tw (Vendor Advisory)

Frequently asked questions

What is CVE-2025-29892?: CVE-2025-29892 is a high-severity vulnerability in Qnap Qsync_central, classified under SQL Injection. CVSS score: 8.8/10. Published 2025-06-06.
How severe is CVE-2025-29892?: High severity. CVSS v3 base score is 8.8 out of 10.