What is the CVSS score of EUVD-2025-17332?

EUVD-2025-17332 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of File Station are affected by EUVD-2025-17332?

CVE-2025-30279 is a certificate validation flaw in QNAP File Station 5 that allows authenticated users to compromise confidentiality, integrity, and availability of file storage systems.. A patch is available.

How to fix or mitigate EUVD-2025-17332?

Within 24 hours: Identify all QNAP File Station 5 deployments and document current versions (check Administration > System Settings > Firmware Version). Within 7 days: Update all instances to File Station 5.5.6.4847 or later via Administration > System Settings > Firmware Update. Within 30 days: audit user access logs for File Station during the period before patching to identify any suspicious authenticated activity, and review user account privileges to enforce least-privilege access.

File Station EUVD-2025-17332

| CVE-2025-30279 HIGH

Improper Certificate Validation (CWE-295)

2025-06-06 security@qnapsecurity.com.tw

Qnap Authentication Bypass File Station

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:44 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

5.5.6.4847

EUVD ID Assigned

Mar 14, 2026 - 18:10 euvd

EUVD-2025-17332

Analysis Generated

Mar 14, 2026 - 18:10 vuln.today

CVE Published

Jun 06, 2025 - 16:15 nvd

HIGH 8.8

DescriptionCVE.org

An improper certificate validation vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system.

We have already fixed the vulnerability in the following version: File Station 5 5.5.6.4847 and later

AnalysisAI

CVE-2025-30279 is an improper certificate validation vulnerability in QNAP File Station 5 that allows authenticated remote attackers to compromise system confidentiality, integrity, and availability. Affected versions are below 5.5.6.4847; the vulnerability requires valid user credentials but no user interaction, making it a significant post-authentication attack vector with a CVSS score of 8.8 indicating high severity.

Technical ContextAI

This vulnerability stems from improper X.509 certificate validation (CWE-295), a critical flaw in SSL/TLS certificate verification mechanisms. File Station 5, a file management service on QNAP NAS systems, fails to properly validate certificates during secure communications, potentially allowing man-in-the-middle (MITM) attacks or bypass of authentication controls. The root cause involves inadequate implementation of certificate chain validation, hostname verification, or certificate pinning mechanisms. An authenticated attacker can exploit this to intercept, modify, or forge secure communications, leading to complete system compromise including unauthorized data access, modification, and service disruption.

RemediationAI

Immediate remediation requires upgrading File Station 5 to version 5.5.6.4847 or later. Organizations should: (1) Apply the vendor patch immediately to all affected QNAP NAS systems; (2) Verify patch deployment through QNAP management interfaces; (3) Review user account access logs for suspicious activities during the vulnerability window; (4) Implement network segmentation to restrict File Station access to trusted networks; (5) Monitor certificate validation errors in system logs; (6) Consider temporary service restrictions until patching is complete. No workarounds are documented; patching is the primary mitigation path. Refer to QNAP's official security advisory for detailed patch deployment procedures and rollback guidance.