Vulnerability in QVPN Device Client, Qsync Client, and Qfinder Pro for Mac

Summary

A time-of-check time-of-use (TOCTOU) race condition vulnerability has been reported to affect several utility versions. If exploited, the vulnerability could allow local attackers who have gained user access to also gain access to otherwise unauthorized resources.

We have already fixed the vulnerability in the following versions:

Recommendation

To secure your device, we recommend regularly updating your QNAP utilities to the latest versions to benefit from vulnerability fixes. You can check the QNAP Utilities page to see the latest updates available to your device operating system.