Qnap CVE-2025-22484

This vulnerability presents moderate-to-high real-world risk within specific deployment contexts. The CVSS 7.1 score reflects: network-accessible attack vector (AV:N), low attack complexity (AC:L), low attack timing requirements (AT:N), and low privilege escalation needs (PR:L—any authenticated user can exploit it). However, the impact is limited to availability (VA:H) with no confidentiality or integrity compromise (VC:N/VI:N). The authentication requirement (PR:L) is a significant constraint—this is not an unauthenticated remote code execution vulnerability. Real-world risk is elevated in environments with untrusted user populations, shared NAS access, or where availability is critical (backup/archival systems, media storage). The lack of confidentiality or integrity impact reduces severity for organizations prioritizing data breach risk. Without confirmed EPSS data, KEV status, or public POC availability provided in the prompt, the risk assessment leans on CVSS signals and CWE context: this is a credible DoS vector that should be prioritized in shared-access NAS environments but is lower priority than authentication bypasses or code execution vulnerabilities.

An attacker with a legitimate or compromised user account on a Qnap NAS system with File Station 5 logs into the file access service. The attacker then initiates repeated file upload operations or creates large numbers of temporary objects (e.g., bulk file operations, nested directory structures, or session objects) without rate limiting. Due to the lack of resource throttling, each operation consumes system memory, file descriptor limits, or temporary storage without being constrained. After sustained exploitation over minutes to hours, the attacker exhausts available system resources. Legitimate users attempting to access File Station 5 or other NAS services experience timeouts, connection rejections, or service degradation. System administrators are alerted to resource exhaustion warnings but cannot easily identify the malicious user's activity if audit logging is insufficient. This scenario is particularly damaging in environments where File Station 5 is a primary backup or archival interface, where availability SLAs are critical. No active exploitation in-the-wild is indicated by the CVE description, making this a preventative patching priority rather than an emergency remediation.