What is the CVSS score of CVE-2025-29876?

CVE-2025-29876 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of File Station are affected by CVE-2025-29876?

QNAP File Station 5 contains a vulnerability allowing authenticated users to crash the application, disrupting file access services for organizational users.. A patch is available.

How to fix or mitigate CVE-2025-29876?

Within 24 hours: Identify all QNAP File Station 5 deployments and document current versions via QNAP admin console. Within 7 days: Apply vendor patch to File Station 5 version 5.5.6.4847 or later across all affected instances, prioritizing production systems. Within 30 days: Audit user access controls and validate patch deployment completion across all QNAP systems.

File Station CVE-2025-29876

EUVD-2025-17334 HIGH

NULL Pointer Dereference (CWE-476)

2025-06-06 security@qnapsecurity.com.tw

Null Pointer Dereference Denial Of Service Qnap File Station

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:44 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

5.5.6.4847

EUVD ID Assigned

Mar 14, 2026 - 18:10 euvd

EUVD-2025-17334

Analysis Generated

Mar 14, 2026 - 18:10 vuln.today

CVE Published

Jun 06, 2025 - 16:15 nvd

HIGH 7.5

DescriptionCVE.org

A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following version: File Station 5 5.5.6.4847 and later

AnalysisAI

NULL pointer dereference vulnerability in QNAP File Station 5 that allows authenticated remote attackers to trigger a denial-of-service condition by crashing the application. While the CVSS score of 7.5 is elevated, the requirement for a valid user account (PR:N is misleading in vector; effective privilege requirement exists) and lack of data confidentiality/integrity impact limit real-world severity. The vulnerability affects File Station 5 versions prior to 5.5.6.4847, and the vendor has released patched versions.

Technical ContextAI

CVE-2025-29876 exploits a NULL pointer dereference (CWE-476) in QNAP File Station 5, a file management service running on QNAP NAS devices. NULL pointer dereference vulnerabilities occur when code attempts to access memory through a null pointer without proper validation, causing an unhandled exception that typically crashes the process. In File Station 5's context, this likely occurs within file operation handlers, metadata processing, or request parsing logic. The vulnerability is triggered remotely (AV:N) but requires an authenticated user account, indicating the flaw exists in post-authentication code paths. QNAP File Station 5 is commonly deployed in enterprise and SOHO environments as part of QNAP QTS operating system, making it a potential target for insider threats or compromised credential scenarios.

RemediationAI

Vendor Patch: Upgrade File Station 5 to version 5.5.6.4847 or later; source: QNAP Official Advisory; priority: High Workaround - Access Control: Restrict File Station 5 access to trusted users; disable external/guest account access; implement IP whitelisting for administrative access if NAS is network-exposed; priority: Medium Workaround - Monitoring: Monitor File Station 5 process health and implement automatic restart policies to minimize DoS impact duration; priority: Medium Workaround - Network Segmentation: Isolate File Station 5 to internal network only; avoid exposing NAS directly to untrusted networks; priority: High Credential Hygiene: Audit user accounts with File Station 5 access; rotate credentials; disable unused accounts; priority: Medium