What is the CVSS score of CVE-2025-29877?

CVE-2025-29877 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of File Station are affected by CVE-2025-29877?

QNAP File Station 5 contains a denial-of-service vulnerability (CVE-2025-29877) that allows authenticated users to crash the application, disrupting file access and collaboration for affected…. A patch is available.

How to fix or mitigate CVE-2025-29877?

Within 24 hours: Identify all QNAP File Station 5 instances in your environment and document current versions. Within 7 days: Apply vendor patch to version 5.5.6.4847 or later across all File Station 5 deployments; prioritize instances with elevated user counts or external access. Within 30 days: Conduct access review of File Station 5 user accounts; disable or restrict privileges for inactive or suspicious accounts; implement enhanced monitoring for application crashes and restart events.

File Station CVE-2025-29877

EUVD-2025-17333 HIGH

NULL Pointer Dereference (CWE-476)

2025-06-06 security@qnapsecurity.com.tw

Null Pointer Dereference Denial Of Service Qnap File Station

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:44 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

5.5.6.4847

EUVD ID Assigned

Mar 14, 2026 - 18:10 euvd

EUVD-2025-17333

Analysis Generated

Mar 14, 2026 - 18:10 vuln.today

CVE Published

Jun 06, 2025 - 16:15 nvd

HIGH 7.5

DescriptionCVE.org

A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following version: File Station 5 5.5.6.4847 and later

AnalysisAI

NULL pointer dereference vulnerability in QNAP File Station 5 that allows authenticated remote attackers to trigger a denial-of-service condition by causing the application to crash. While the CVSS 7.5 score reflects the severity of availability impact, the vulnerability requires valid user credentials to exploit, making it primarily a risk for organizations with compromised or malicious insider accounts. The vendor has released patches in version 5.5.6.4847 and later.

Technical ContextAI

The vulnerability resides in QNAP File Station 5 (CPE: cpe:2.3:a:qnap:file_station:5:*:*:*:*:*:*:*), a file management application commonly deployed on QNAP NAS devices. The root cause is classified under CWE-476 (NULL Pointer Dereference), which occurs when the application attempts to dereference a pointer that has not been properly initialized or validated before use. This type of memory safety flaw typically results from insufficient input validation or error handling during file operations or session management within File Station's backend services. The NULL pointer dereference likely occurs in a code path that processes authenticated user requests, possibly related to file operations, metadata handling, or session state management.

RemediationAI

action: Immediate Patch; description: Upgrade File Station 5 to version 5.5.6.4847 or later. Apply patches through QNAP's official security advisories and firmware update mechanisms.
action: Access Control; description: Implement strict authentication controls and restrict File Station 5 access to trusted users only. Enforce strong passwords and multi-factor authentication (MFA) if supported by the NAS platform.
action: Network Segmentation; description: Isolate File Station 5 and underlying NAS devices on protected network segments with restricted access from untrusted networks. Use firewall rules to limit administrative access.
action: Monitoring; description: Monitor File Station 5 service logs for unexpected crashes or DoS patterns. Implement alerting for service restarts or availability anomalies.
action: Audit User Accounts; description: Conduct an audit of all File Station 5 user accounts and remove or disable unnecessary accounts, particularly those with elevated privileges.