EUVD-2025-17336Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | This vulnerability presents a moderate-to-high real-world risk with context-dependent criticality. CVSS 7.5 reflects a High-severity availability impact (A:H) with network accessibility (AV:N), but several factors influence actual risk: (1) Requires prior authentication (PR:N in vector indicates unauthenticated access, suggesting the 'user account' requirement may be weaker than initially implied, or the vector description is for post-authentication scenarios), making mass exploitation less likely than a network-worm scenario; (2) Impact is denial-of-service only (C:N, I:N), not data exfiltration or system compromise; (3) SSVC considerations: if actively exploited in the wild (KEV status unknown from provided data), automatable (likely yes—resource exhaustion is trivial to automate), and technical impact is high (service unavailability), this escalates priority; (4) The patch is available (version 5.5.6.4847+), reducing exploitation window for patched deployments. Organizations with legacy or unpatched File Station instances in production environments should prioritize patching. This is NOT a critical vulnerability but warrants timely remediation to prevent operational disruption. |
| Exploit ScenarioDerived | An attacker with a valid File Station user account (obtained through credential compromise, insider threat, or provided through legitimate business need) logs in to File Station 5 running on a vulnerable QNAP NAS. The attacker crafts a simple script that sends rapid, resource-intensive requests (e.g., large file listings, bulk metadata operations, or concurrent connections) to File Station without rate-limiting protection. The uncontrolled resource allocation exhausts available file handles, memory, or thread pools on the NAS, causing File Station to become unresponsive. Legitimate users attempting to access files are denied service. The attacker does not require zero-day knowledge—basic HTTP requests or protocol interactions trigger the vulnerability. Patch application in File Station 5.5.6.4847+ introduces resource quotas, throttling per user/session, or connection limits that prevent this scenario. PoC code is likely trivial (curl loops, Python requests, or similar), but specific public PoC availability is unknown from provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 14, 2026
Denial-of-service vulnerability in QNAP File Station 5 that allows an authenticated attacker to exhaust system resources without limits or throttling, preventing legitimate users and processes from accessing the affected service. The vulnerability affects File Station 5 versions prior to 5.5.6.4847 and is remotely exploitable with no user interaction required once account access is obtained. With a CVSS score of 7.5 (High) and network-based attack vector, this represents a significant availability risk for organizations relying on File Station for network file access.
RemediationAI
Immediate remediation: (1) Upgrade File Station 5 to version 5.5.6.4847 or later; download from QNAP's official support portal for your NAS model; (2) Verify patch application by checking File Station version in the admin console; (3) Short-term mitigations pending patching: restrict File Station access to trusted IP ranges via firewall ACLs; disable File Station if not actively required; monitor resource usage (CPU, memory, I/O, active sessions) for anomalies; implement connection limits or rate-limiting at the reverse proxy/load balancer layer if File Station is exposed externally; audit and revoke unnecessary user accounts to reduce attack surface. Long-term: maintain a patch schedule for QNAP firmware and applications; monitor QNAP security advisories regularly.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability exploits improper resource allocation handling in QNAP File Station 5, classified under CWE-770 (Allocation of Resources Without Limits or Throttling). The root cause involves the absence of rate limiting, request throttling, or resource quota mechanisms in File Station's request handling pipeline. An authenticated user can trigger unbounded resource consumption (likely file handles, memory, I/O operations, or concurrent connection slots) that degrades service availability. The vulnerability is specific to File Station 5, which is QNAP's proprietary file management interface running on their NAS systems (CPE likely qnap:file_station or similar). The lack of AC:L (Low Complexity) in the CVSS vector indicates the attack requires only basic user privileges and standard protocol requests, with no special conditions needed for exploitation.
Know when File Station gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource.
We have already fixed the vulnerability in the following version: File Station 5 5.5.6.4847 and later
Executive ViewAI
QNAP File Station 5 contains a high-severity denial-of-service vulnerability (CVE-2025-29872) that allows authenticated users to exhaust system resources and render the file-sharing service unavailable to legitimate users. Organizations using File Station 5 should prioritize patching to prevent service disruptions that could impact file access and business continuity across dependent applications and users.
Apply vendor patch. Interim mitigation: restrict File Station 5 network access via firewall rules to trusted internal subnets only; enforce strong authentication policies and monitor for unusual account activity; implement rate limiting at the network level if QNAP does not provide native throttling controls; disable unused File Station accounts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in File Station
View allCVE-2025-33031 is an improper certificate validation vulnerability in Synology File Station 5 that allows authenticated
CVE-2025-30279 is an improper certificate validation vulnerability in QNAP File Station 5 that allows authenticated remo
CVE-2025-29885 is an improper certificate validation vulnerability in Synology File Station 5 that allows authenticated
CVE-2025-29884 is an improper certificate validation vulnerability affecting Synology File Station 5 that allows authent
CVE-2025-29883 is an improper certificate validation vulnerability affecting Synology File Station 5 that allows authent
CVE-2025-22486 is an improper certificate validation vulnerability in Synology File Station 5 that allows authenticated
An improper neutralization of directives in statically saved code ('Static Code Injection') vulnerability has been repor
NULL pointer dereference vulnerability in QNAP File Station 5 that allows authenticated remote attackers to trigger a de
NULL pointer dereference vulnerability in QNAP File Station 5 that allows authenticated remote attackers to trigger a de
NULL pointer dereference vulnerability affecting QNAP File Station 5 that allows authenticated remote attackers to trigg
NULL pointer dereference vulnerability in QNAP File Station 5 that allows authenticated remote attackers to trigger a de
A weak authentication vulnerability has been reported to affect File Station 5. The remote attackers can then exploit th
GitHub PoC
Exploit-DB