File Station CVE-2025-29873

The CVSS 7.5 (High) rating reflects legitimate concern due to network accessibility and high availability impact. However, several factors moderate real-world risk: (1) The vulnerability requires user-level authentication (PR:L implied by 'user account' requirement in description), reducing opportunistic exploitation; (2) Impact is limited to denial-of-service only—no confidentiality or integrity compromise; (3) The attack requires active exploitation rather than passive network presence (AC:L but not automatic). Without EPSS data, KEV/CISA tracking status, or public POC availability indicated, this appears to be a moderate-to-high priority vulnerability suitable for standard patching cycles rather than emergency response. Organizations should prioritize patching File Station 5 instances exposed to untrusted users or less-trusted network segments.

A remote attacker with valid File Station 5 credentials (obtained through weak passwords, credential stuffing, or internal compromise) authenticates to the File Station 5 web interface or API. The attacker then crafts a specific malformed request targeting a file operation or API endpoint that triggers the NULL pointer dereference in the application's code. The application crashes, causing File Station 5 service to become unavailable, preventing legitimate users from accessing shared files and storage. If File Station 5 is a critical service (backup destination, departmental file share), this DoS impact could affect business operations. The attack requires no special complexity or user interaction and can be automated for multiple targets, but requires valid authentication credentials, limiting casual exploitation to compromised accounts or insider threats.