CVE-2023-47564 is an incorrect permission assignment flaw in QNAP's Qsync Central. NVD scores it 8.0, High. The fixes are Qsync Central 4.4.0.15 (2024/01/04) and later, and 4.3.0.11 (2024/01/11) and later. Qsync Central syncs files between a NAS and many devices. Update the app on each NAS that runs it.
What's affected
The record lists Qsync Central without a version range, with two fixed lines. QNAP's text names Qsync Central 4.4.0.15 (2024/01/04) and later, and Qsync Central 4.3.0.11 (2024/01/11) and later.
The weaknesses listed in the record: CWE-732.
The NVD vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. QNAP's advisory page needs a browser to render, so I could not read it directly. The fixed versions below come from the NVD record, which reproduces QNAP's text.
How to check if you're exposed
Open the QNAP management interface and read the version of the affected product. For the operating system, that is the Firmware Update page in Control Panel. For an app, it is the App Center entry. Compare what you see with the fixed versions listed above.
I am not giving a command line check. QNAP's own pages and the device interface are the supported route, and I could not confirm a command that works across all models.
What to do now
- Update Qsync Central to 4.4.0.15 or later if you are on the 4.4 line, or to 4.3.0.11 or later if you are on 4.3.
- Check the version on each NAS that runs Qsync Central.
- Review the sharing and folder permissions that Qsync syncs, and remove access that is no longer needed.
- Review the accounts that sign in to the NAS, and disable unused ones.
- Keep the NAS off the public internet and use a VPN.
Why it matters
The weakness is CWE-732, incorrect permission assignment for a critical resource. Here an authenticated user could read or modify a resource over the network. The NVD vector adds user interaction as Required, which means someone has to take an action, such as opening or syncing something, for the harm to land.
Permission flaws are quieter than command injection, but they can have wide effects. Qsync is built to push files between a NAS and many client devices, so a resource with the wrong permissions touches files that people trust and open without thinking.
The score of 8.0 reflects high impact on confidentiality, integrity and availability, with a low privilege requirement. The user interaction step is what keeps it under 8.8. If your Qsync folders carry shared documents across a team, treat the update as a priority.
Quick check
Why are there two fixed versions?
QNAP maintains two release lines of Qsync Central, and each has its own fixed build.
Does the user need to click something?
NVD's vector says user interaction is required.
Sources
Last reviewed: 19 October 2026.
