What is the CVSS score of CVE-2025-29884?

CVE-2025-29884 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of File Station are affected by CVE-2025-29884?

CVE-2025-29884 is a certificate validation flaw in Synology File Station 5 that permits authenticated users to fully compromise system confidentiality, integrity, and availability.. A patch is available.

How to fix or mitigate CVE-2025-29884?

Within 24 hours: Identify all Synology File Station 5 instances in your environment and document current versions. Within 7 days: Apply the vendor-released patch to all affected File Station 5 deployments and verify successful installation. Within 30 days: Conduct access reviews to restrict File Station user accounts to only necessary personnel and implement network segmentation to limit authenticated user connections to File Station if feasible.

File Station CVE-2025-29884

EUVD-2025-17345 HIGH

Improper Certificate Validation (CWE-295)

2025-06-06 security@qnapsecurity.com.tw

Synology Authentication Bypass File Station

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:44 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

5.5.6.4791

EUVD ID Assigned

Mar 14, 2026 - 18:10 euvd

EUVD-2025-17345

Analysis Generated

Mar 14, 2026 - 18:10 vuln.today

CVE Published

Jun 06, 2025 - 16:15 nvd

HIGH 8.8

DescriptionCVE.org

An improper certificate validation vulnerability has been reported to affect File Station 5. If exploited, the vulnerability could allow remote attackers who have gained user access to compromise the security of the system.

We have already fixed the vulnerability in the following versions: File Station 5 5.5.6.4791 and later and later

AnalysisAI

CVE-2025-29884 is an improper certificate validation vulnerability affecting Synology File Station 5 that allows authenticated remote attackers to compromise system confidentiality, integrity, and availability. The vulnerability requires user-level access but enables complete system compromise with high impact across all security dimensions. No active KEV or public POC data is currently available, but the CVSS 8.8 score and low attack complexity indicate this should be prioritized for patching.

Technical ContextAI

This vulnerability stems from improper certificate validation (CWE-295), a common SSL/TLS implementation flaw where the application fails to properly verify X.509 certificates during secure communications. In File Station 5, this likely affects HTTPS/TLS connections used for web interface authentication, file transfer operations, or backend service communications. The vulnerability allows attackers who have already obtained legitimate user credentials to perform man-in-the-middle (MITM) attacks by presenting invalid or self-signed certificates that the application fails to validate, bypassing intended security controls. The affected product CPE would be: cpe:2.3:a:synology:file_station:5.0:*:*:*:*:*:*:* through versions prior to 5.5.6.4791.

RemediationAI

Upgrade File Station 5 to version 5.5.6.4791 or later immediately; priority: Critical; details: Apply official Synology security patch. Check Synology's advisory portal and download center for File Station 5 updates Workaround (Temporary): Restrict network access to File Station 5 web interface to trusted IP ranges using firewall rules; priority: High; details: Limit exposure while patch deployment is being staged; implement VPN-only access if possible Monitoring: Monitor for suspicious certificate warnings in File Station logs and failed HTTPS connections; priority: High; details: Establish alerting for TLS/certificate validation failures that may indicate MITM attempts Credential Review: Reset user credentials for high-privilege File Station accounts as a precautionary measure post-patching; priority: Medium; details: If any suspicious activity occurred, assume credential compromise and enforce password resets