VulnerabilityDeferred

CVE-2024-53694

A time-of-check time-of-use (TOCTOU) race condition vulnerability has been reported to affect several product versions.

HIGH 8.6EPSS 0.13%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.13%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

A time-of-check time-of-use (TOCTOU) race condition vulnerability has been reported to affect several product versions. If exploited, the vulnerability could allow local attackers who have gained user access to gain access to otherwise unauthorized resources. We have already fixed the vulnerability in the following versions: QVPN Device Client for Mac 2.2.5 and later Qsync for Mac 5.1.3 and later Qfinder Pro Mac 7.11.1 and later

CVSS 4.0: 8.6 HIGHCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.13% probability · 3th percentile
CISA KEV: Not listed
Weakness: CWE-367
Source: security@qnapsecurity.com.tw

References

https://www.qnap.com/en/security-advisory/qsa-24-51

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.