CVE-2024-53694highCWE-367

CVE-2024-53694: high-severity vulnerability in QNAP Systems Inc. QVPN Device Client for Mac

QVPN Device Client, Qsync, Qfinder Pro

Published

Follow this CVE+ Monitor Qsync+ Monitor Qfinder Pro Mac

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.6epss 0.1%
A time-of-check time-of-use (TOCTOU) race condition vulnerability has been reported to affect several product versions. If exploited, the vulnerability could allow local attackers who have gained user access to gain access to otherwise unauthorized resources. We have already fixed the vulnerability in the following versions: QVPN Device Client for Mac 2.2.5 and later Qsync for Mac 5.1.3 and later Qfinder Pro Mac 7.11.1 and later
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Affected products
QNAP Systems Inc. · Qfinder Pro MacQNAP Systems Inc. · Qsync for MacQNAP Systems Inc. · QVPN Device Client for Mac
Related CVEs — QNAP Systems Inc. QVPN Device Client for Mac

In the same product, most dangerous first.

CVE-2025-53594MEDIUMQfinder Pro, Qsync, QVPNEPSS 0.1%