EUVD-2025-17339Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Lifecycle Timeline
6DescriptionCVE.org
An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource.
We have already fixed the vulnerability in the following version: File Station 5 5.5.6.4847 and later
AnalysisAI
CVE-2025-22484 is an unthrottled resource allocation vulnerability in Qnap File Station 5 that allows authenticated remote attackers to exhaust system resources and cause denial of service. An attacker with valid user credentials can exploit this CWE-770 weakness to prevent legitimate users and processes from accessing shared resources, affecting availability. The vulnerability has a moderate-to-high CVSS 7.1 score driven by network accessibility and high availability impact, though it requires prior authentication; the fix is available in File Station 5 version 5.5.6.4847 and later.
Technical ContextAI
The vulnerability resides in Qnap File Station 5, a network file storage access application commonly deployed in NAS environments. The root cause is classified under CWE-770 (Allocation of Resources Without Limits or Throttling), which occurs when the application fails to implement rate limiting, quota enforcement, or resource exhaustion protections on user-initiated operations. This allows an authenticated user to allocate unbounded system resources (likely memory, file handles, connection pools, or temporary storage) through repeated requests or large-scale operations, exhausting the resource pool and triggering denial of service conditions for other legitimate users. The vulnerability is specific to File Station 5 versions prior to 5.5.6.4847, indicating the resource allocation mechanisms were redesigned or throttling controls were added in the patched release.
RemediationAI
Immediate action: Upgrade to File Station 5 version 5.5.6.4847 or later. This is the patched version confirmed to resolve the vulnerability. Organizations should: (1) Test the patch in a non-production environment first to ensure compatibility; (2) Apply the update to all File Station 5 instances in the environment; (3) Document and track patch deployment; (4) Review access controls to ensure only trusted users have access to File Station 5. Interim mitigations (if patching is delayed): Restrict user account creation and audit existing accounts to remove unnecessary access; implement network-level rate limiting or WAF rules on File Station 5 endpoints if deployed behind a reverse proxy; monitor system resource utilization (memory, file handles, CPU) for anomalous consumption patterns indicative of resource exhaustion attacks; isolate critical NAS services on separate systems if high availability is required. Long-term: Subscribe to Qnap security bulletins and enable automatic patching if available.
More from same product – last 7 days
Cross-site scripting in QNAP QTS and QuTS hero operating systems allows remote attackers to bypass security mechanisms a
Authenticated command injection in QNAP QTS and QuTS hero NAS operating systems allows a remote attacker who has already
Authenticated command injection in QNAP QTS and QuTS hero allows a remote attacker holding administrator credentials to
Authenticated command injection in QNAP QTS and QuTS hero NAS operating systems allows attackers with administrator cred
Authenticated command injection in QNAP QTS and QuTS hero NAS operating systems allows an attacker who already holds an
Share
External POC / Exploit Code
Leaving vuln.today