What is the CVSS score of CVE-2025-33031?

CVE-2025-33031 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of File Station are affected by CVE-2025-33031?

Synology File Station 5 contains an improper certificate validation flaw (CVE-2025-33031, CVSS 8.8) that allows authenticated users to intercept and manipulate file transfer communications through…. A patch is available.

How to fix or mitigate CVE-2025-33031?

Within 24 hours: Identify all Synology NAS devices running File Station 5 and document current versions. Within 7 days: Deploy Synology patch to version 5.5.6.4847 or later across all affected File Station 5 instances via Synology DSM update mechanism; test in non-production environment first. Within 30 days: Audit File Station 5 user access logs for suspicious certificate validation bypass attempts and review any inter-system communications that may have occurred over unvalidated TLS connections during the vulnerability window.

File Station CVE-2025-33031

EUVD-2025-17331 HIGH

Improper Certificate Validation (CWE-295)

2025-06-06 security@qnapsecurity.com.tw

Information Disclosure File Station

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:44 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

5.5.6.4847

EUVD ID Assigned

Mar 14, 2026 - 18:10 euvd

EUVD-2025-17331

Analysis Generated

Mar 14, 2026 - 18:10 vuln.today

CVE Published

Jun 06, 2025 - 16:15 nvd

HIGH 8.8

DescriptionCVE.org

An improper certificate validation vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system.

We have already fixed the vulnerability in the following version: File Station 5 5.5.6.4847 and later

AnalysisAI

CVE-2025-33031 is an improper certificate validation vulnerability in Synology File Station 5 that allows authenticated remote attackers to compromise system confidentiality, integrity, and availability. An attacker with valid user credentials can exploit insufficient SSL/TLS certificate validation to perform man-in-the-middle attacks or bypass security controls. The vulnerability has a high CVSS score of 8.8 and affects all versions of File Station 5 prior to 5.5.6.4847; patches are available from Synology.

Technical ContextAI

This vulnerability stems from CWE-295 (Improper Certificate Validation), a root cause class where applications fail to properly validate X.509 certificates during SSL/TLS handshakes. In the context of File Station 5, the affected product likely uses certificate validation for secure communications with backend services, storage systems, or client connections. The improper validation mechanism may accept self-signed certificates, expired certificates, or certificates with mismatched hostnames, allowing attackers with network access to intercept encrypted communications. File Station 5 is Synology's web-based file management solution (CPE pattern: cpe:2.3:a:synology:file_station:*). The vulnerability requires prior authentication, indicating the certificate validation flaw exists within authenticated user session handling or inter-service communication chains.