What is the CVSS score of CVE-2025-22490?

CVE-2025-22490 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of File Station are affected by CVE-2025-22490?

QNAP File Station 5 contains a NULL pointer dereference vulnerability (CVE-2025-22490) that allows authenticated users to crash the application, disrupting file access for all organizational users.. A patch is available.

How to fix or mitigate CVE-2025-22490?

Within 24 hours: Audit current File Station 5 deployment version and identify all systems running versions prior to 5.5.6.4847. Within 7 days: Apply vendor patch to upgrade File Station 5 to version 5.5.6.4847 or later on all affected instances. Within 30 days: Verify patch deployment across all File Station 5 instances and document completion in your patch management system.

File Station CVE-2025-22490

EUVD-2025-17338 HIGH

NULL Pointer Dereference (CWE-476)

2025-06-06 security@qnapsecurity.com.tw

Null Pointer Dereference Denial Of Service Qnap File Station

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:44 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

5.5.6.4847

EUVD ID Assigned

Mar 14, 2026 - 18:10 euvd

EUVD-2025-17338

Analysis Generated

Mar 14, 2026 - 18:10 vuln.today

CVE Published

Jun 06, 2025 - 16:15 nvd

HIGH 7.5

DescriptionCVE.org

A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following version: File Station 5 5.5.6.4847 and later

AnalysisAI

NULL pointer dereference vulnerability in QNAP File Station 5 that allows authenticated remote attackers to trigger a denial-of-service condition by crashing the application. The vulnerability affects File Station 5 versions prior to 5.5.6.4847, and while it requires valid user credentials (PR:N indicates no privileges required once authenticated), it has a CVSS score of 7.5 reflecting high availability impact. No indication of active exploitation in the wild or public POC is evident from the provided data.

Technical ContextAI

CVE-2025-22490 represents a CWE-476 (NULL Pointer Dereference) vulnerability within QNAP's File Station 5 application, a network-attached storage (NAS) file management service. The vulnerability likely exists in the application layer where improper null pointer validation occurs during request processing—potentially in file handling, metadata processing, or API endpoint handlers. File Station 5 is a core component of QNAP NAS devices and runs as a web-based service accessible over HTTP/HTTPS (AV:N). The NULL dereference suggests unsafe memory access patterns in C/C++ code where pointer validation is insufficient before dereferencing, leading to unhandled exceptions that crash the service. The AC:L (Low Complexity) rating indicates the vulnerability is trivial to exploit once authenticated.

RemediationAI

Immediate remediation: Update File Station 5 to version 5.5.6.4847 or later. For QNAP NAS devices, this requires: (1) Accessing the NAS administration interface (typically https://<nas-ip>:8081); (2) Navigating to System Settings > Firmware Update or App Center; (3) Checking for File Station 5 updates and applying the patched version; (4) Rebooting if required. Interim mitigations while patching: (a) Restrict File Station 5 access via firewall rules to trusted IP ranges only; (b) Disable File Station 5 if not in active use; (c) Enforce strong password policies and multi-factor authentication for NAS user accounts; (d) Monitor application logs for NULL pointer exceptions (typically logged as segmentation faults or unhandled exceptions in syslog). Verify patch application by checking File Station 5 version in the application's about/settings page to confirm ≥5.5.6.4847.