File Station 5 EUVD-2026-101876

Exploitation requires the attacker to first obtain a valid low-privileged user account on a QNAP NAS running the File Station 5 application (PR:L), after which a crafted request remotely triggers the NULL pointer dereference. The primary limiting factor is this authentication requirement - the attacker must already have credentials or an account on the device - which confines realistic exploitation to malicious insiders or attackers who have separately compromised a user login. Impact is limited to denial of service of the File Station 5 app on versions prior to 5.5.6.5243; no user interaction is needed (UI:N), and no confidentiality or integrity impact occurs.

This is a genuinely low-priority issue despite being network-reachable. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) with vulnerable-system impact limited to VA:L (low availability, no confidentiality or integrity) yields a vendor base score of only 1.3, which aligns with the described impact: a NULL pointer dereference causing a denial-of-service of the File Station 5 application. PR:L confirms an authenticated attacker is required - a valid user account on the NAS - which substantially limits the exploit population to insiders or attackers who have already obtained credentials. The vector's E:U (Exploit: Unreported) is consistent with the absence of any POC or KEV signal: no public exploit identified at time of analysis, and the vulnerability is not in CISA KEV. Signals are internally consistent here (no conflicts): a low-impact, low-probability, authentication-gated DoS. The only nuance worth verifying is the real-world crash blast radius - whether the dereference crashes only the File Station 5 service/session or can disrupt the broader NAS - but the VA:L (not VA:H) rating indicates the vendor assesses impact as limited, not a full system outage.

An attacker who already holds a low-privileged user account on a QNAP NAS running File Station 5 sends a crafted request to the File Station service that triggers an unhandled NULL pointer dereference, crashing the process and denying file-management service to legitimate users. No public exploit code is available, and the attacker gains no data access or code execution - only a temporary service disruption.