File Station CVE-2025-29877

The CVSS 7.5 score (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) indicates high availability impact with network-based attack vector and low attack complexity; however, the vector string contains a critical signal often overlooked: PR:N appears inconsistent with the description stating 'remote attacker gains a user account.' The accurate interpretation is PR:L (Low Privileges Required), as authentication is mandatory, which would lower CVSS to approximately 6.5. The vulnerability poses moderate real-world risk: it requires valid credentials, limiting the attack surface to insider threats or scenarios where account compromise has occurred. Without confirmed KEV status, public POC, or high EPSS score data, this should be prioritized below unauthenticated critical vulnerabilities but above low-impact issues. SSVC considerations: exploitation is likely possible (authentication requirement known), may be automatable (NULL dereference crashes are predictable), and technical impact is high (service unavailability). Organizations with strict access controls and credential hygiene face lower risk.

An insider with compromised File Station 5 credentials (or a threat actor who has obtained valid credentials through phishing or credential stuffing) authenticates to the File Station 5 web interface. The attacker then crafts a malicious file operation request—such as accessing a specially named file, performing bulk operations, or triggering specific metadata queries—that causes the application to dereference a NULL pointer in the file handling code path. The NULL pointer dereference triggers an unhandled exception, causing the File Station 5 service to crash. This results in denial of service for all users attempting to access file management functionality on the affected QNAP NAS device. The attacker can repeat this action to maintain service unavailability. While the CVSS vector shows no privilege escalation or data confidentiality impact, the availability impact is significant in environments where NAS file services are business-critical.