File Station CVE-2025-22486

The CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H vector indicates moderate-to-high real-world risk: Network accessibility (AV:N) and low attack complexity (AC:L) are concerning, but the requirement for authenticated privileges (PR:L) significantly limits the threat surface. The High impact across all three CIA triad dimensions (C:H/I:H/A:H) reflects that successful exploitation enables full system compromise. Without confirmed EPSS scores or KEV/CISA inclusion data, we assess this as a HIGH priority for organizations running vulnerable File Station versions with multiple users, particularly in zero-trust networks or where user accounts may be compromised. The severity is primarily driven by post-authentication attack capability rather than widespread pre-auth exploitability. Organizations with properly segmented networks and strict user access controls face lower real-world risk than those with permissive internal network policies.

An attacker with valid File Station credentials (e.g., obtained through phishing or credential compromise) connects to an affected File Station 5 instance over the network. The application initiates a TLS connection to a backend Synology service (such as authentication, data sync, or backup service) without properly validating the server's certificate. The attacker positions themselves on the network path (via ARP spoofing, DNS hijacking, or compromised router) and presents a self-signed or attacker-controlled certificate. Due to the improper validation (CWE-295), File Station accepts the fraudulent certificate and establishes the TLS connection to the attacker's server. The attacker then either: (1) intercepts and modifies requests/responses to extract sensitive file data or system information (C:H), (2) injects malicious commands to modify files or configurations (I:H), or (3) causes denial of service by disrupting the service connection (A:H). The attack requires PR:L (user account) but no user interaction (UI:N), making it automatable within compromised user sessions. Exploitation is most likely in scenarios where multiple users share a NAS or where attacker-controlled machines exist on the internal network.