Vulnerability · Published Mar 7, 2025 · Assigned by qnap
CVE-2024-53694QVPN Device Client, Qsync, Qfinder Pro
High 8.6
In plain English
A high-severity security flaw in Qfinder Pro Mac from QNAP Systems Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).
Official description
A time-of-check time-of-use (TOCTOU) race condition vulnerability has been reported to affect several product versions. If exploited, the vulnerability could allow local attackers who have gained user access to gain access to otherwise unauthorized resources. We have already fixed the vulnerability in the following versions: QVPN Device Client for Mac 2.2.5 and later Qsync for Mac 5.1.3 and later Qfinder Pro Mac 7.11.1 and later
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| QNAP Systems Inc. | QVPN Device Client for Mac | 2.2.x – before 2.2.5 |
| QNAP Systems Inc. | Qsync for Mac | 5.1.x – before 5.1.3 |
| QNAP Systems Inc. | Qfinder Pro Mac | 7.11.x – before 7.11.1 |
Weakness: CWE-367 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H