File Station CVE-2025-33031

CVSS 8.8 (High) with network attack vector, low complexity, and low privileges required (authenticated user) reflects the practical severity. The vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates: (1) network-exploitable without user interaction, (2) no special conditions required beyond valid credentials, (3) full impact on confidentiality (data theft), integrity (data modification), and availability (DoS). The requirement for valid user credentials (PR:L) significantly reduces the threat surface compared to unauthenticated vulnerabilities. However, the attack complexity is low, meaning an attacker with compromised or legitimate credentials can reliably exploit this. Real-world risk depends on: whether File Station 5 deployments are internet-facing (increasing PR:L attack feasibility), the prevalence of weak credential hygiene in Synology NAS deployments, and whether this vulnerability is being actively exploited in the wild. Without explicit KEV status or EPSS data, this should be treated as high priority for internet-facing deployments and organizations with weak access controls, but medium priority for internal-only NAS systems with strong credential policies.

A user's credentials for a Synology NAS running File Station 5 (version < 5.5.6.4847) are compromised through phishing, credential stuffing, or leaked password databases. The attacker gains network access (internal or remote, depending on deployment). The attacker can then position themselves on the network path (via ARP spoofing, DNS hijacking, or compromised network infrastructure) and intercept traffic from the File Station 5 service. Due to improper certificate validation, the application accepts the attacker's self-signed or spoofed certificate, allowing the attacker to decrypt session traffic, harvest sensitive files, modify data in transit, or inject malicious commands. Alternatively, the attacker uses the authentication bypass potential of improper validation to escalate privileges or access restricted file shares. The low-complexity attack vector and lack of user interaction (UI:N) means the exploit can be automated once credentials are obtained.