EUVD-2025-17344
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Description
An improper certificate validation vulnerability has been reported to affect File Station 5. If exploited, the vulnerability could allow remote attackers who have gained user access to compromise the security of the system. We have already fixed the vulnerability in the following versions: File Station 5 5.5.6.4791 and later and later
Analysis
CVE-2025-29883 is an improper certificate validation vulnerability affecting Synology File Station 5 that allows authenticated remote attackers to compromise system security through man-in-the-middle attacks or credential harvesting. The vulnerability requires valid user credentials (PR:L) but can result in complete system compromise with high impact to confidentiality, integrity, and availability (CVSS 8.8). Patched versions are available for File Station 5 5.5.6.4791 and later.
Technical Context
This vulnerability is rooted in CWE-295 (Improper Certificate Validation), a common weakness in SSL/TLS implementations where applications fail to properly validate X.509 certificates during secure communications. File Station 5, Synology's web-based file management application, likely fails to verify certificate chains, check certificate expiration, validate hostname/CN matching, or properly handle self-signed or revoked certificates. This allows attackers on the network path to intercept encrypted communications using fraudulent certificates. The vulnerability exists in the application layer where File Station communicates with backend services or external systems, possibly during authentication, file transfer operations, or API communications. Affected CPE: cpe:2.3:a:synology:file_station_5:*:*:*:*:*:*:*:* (versions prior to 5.5.6.4791).
Affected Products
File Station 5 (5.5.6.4790 and earlier)
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today