CVE-2024-53694

HighCVSS 8.6/10Last modified Jun 17, 2026

Description

A time-of-check time-of-use (TOCTOU) race condition vulnerability has been reported to affect several product versions. If exploited, the vulnerability could allow local attackers who have gained user access to gain access to otherwise unauthorized resources.

We have already fixed the vulnerability in the following versions: QVPN Device Client for Mac 2.2.5 and later Qsync for Mac 5.1.3 and later Qfinder Pro Mac 7.11.1 and later

Metrics

CVSS 4.0 8.6/10

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-367

Affected software

No affected versions have been published.

Timeline

Published: Mar 7, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-536959.1A buffer overflow vulnerability has been reported to affect HBS 3 Hybrid Backup Sync. If exploited, the vulnerability could allow remote att CVE-2024-536964.9A server-side request forgery (SSRF) vulnerability has been reported to affect QuLog Center. If exploited, the vulnerability could allow rem CVE-2024-536977.2An out-of-bounds write vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability cou CVE-2024-536984.9A double free vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow CVE-2024-536997.2An out-of-bounds write vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability cou CVE-2024-53706.1A vulnerability was found in Kashipara College Management System 1.0. It has been rated as problematic. Affected by this issue is some unkno CVE-2024-537007.2A command injection vulnerability has been reported to affect QHora. If exploited, the vulnerability could allow remote attackers who have g CVE-2024-537013.1Multiple FCNT Android devices provide the original security features such as "privacy mode" where arbitrary applications can be set not to b CVE-2024-537025.3Use of cryptographically weak pseudo-random number generator (PRNG) vulnerability in the SonicWall SMA100 SSLVPN backup code generator that,CVE-2024-537038.1A vulnerability in the SonicWall SMA100 SSLVPN firmware 10.2.1.13-72sv and earlier versions mod_httprp library loaded by the Apache web serv CVE-2024-537049.8An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass authentication.CVE-2024-537057.5A Server-Side Request Forgery vulnerability in the SonicOS SSH management interface allows a remote attacker to establish a TCP connection t