File Station 5 CVE-2026-24722

Exploitation requires the attacker to first gain a valid File Station 5 / QNAP NAS user account (PR:L) - it is not reachable by anonymous or unauthenticated users. Given a valid account, the crafted request can be sent remotely over the network (AV:N) with low complexity (AC:L) and no user interaction (UI:N). The description names no special non-default feature or configuration mode beyond File Station 5 being installed and reachable. The principal limiting factor is the authentication requirement: an attacker must already hold or obtain NAS credentials, which bounds this to insiders or attackers who have otherwise acquired a low-privileged account. Impact is limited to a denial-of-service of the File Station application; confidentiality and integrity are unaffected.

All available signals point to this being a genuinely low-priority issue rather than a high-CVSS-but-low-real-risk mismatch - the signals are consistent, not conflicting. The vendor CVSS 4.0 base score is only 1.3, driven by availability-only impact (VA:L) with no confidentiality or integrity effect (VC:N/VI:N), and the vector requires an authenticated attacker (PR:L). The CVSS 4.0 Exploit Maturity is explicitly E:U (Unproven), there is no CISA KEV listing, and no public exploit code or POC is referenced. The one reference is a generic QNAP release-notes page rather than a detailed advisory, and no EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here. The impact is a transient denial-of-service of a single application (File Station 5), not remote code execution or data compromise. Net assessment: real but minor - standard patching priority, not an emergency.

An attacker who already possesses a valid low-privileged QNAP NAS user account sends a crafted request to the File Station 5 application that triggers a NULL pointer dereference (CWE-476), crashing the service and denying file-access functionality to legitimate users. No public exploit code is identified at time of analysis, and the CVSS 4.0 Exploit Maturity is marked Unproven (E:U). Because AV:N/AC:L applies, the crafted request can be delivered over the network with low complexity, but valid authentication is still required.