Skip to main content

CVE-2025-22484: CWE-770 in QNAP Systems Inc. File Station 5

High
VulnerabilityCVE-2025-22484cvecve-2025-22484cwe-770
Published: Fri Jun 06 2025 (06/06/2025, 15:52:59 UTC)
Source: CVE Database V5
Vendor/Project: QNAP Systems Inc.
Product: File Station 5

Description

An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.4847 and later

AI-Powered Analysis

AILast updated: 07/08/2025, 05:26:13 UTC

Technical Analysis

CVE-2025-22484 is a high-severity vulnerability classified under CWE-770, which pertains to the allocation of resources without limits or throttling. This vulnerability affects QNAP Systems Inc.'s File Station 5, specifically versions 5.5.x prior to 5.5.6.4847. File Station 5 is a file management application commonly used on QNAP NAS devices to facilitate file sharing and management over a network. The vulnerability allows a remote attacker who has already obtained a user account on the system to exploit the lack of resource allocation limits. By doing so, the attacker can exhaust certain system resources, effectively causing a denial of service (DoS) condition that prevents other systems, applications, or processes from accessing the same type of resource. The vulnerability does not require user interaction and can be exploited remotely with low complexity, as indicated by the CVSS vector (AV:N/AC:L/PR:L/UI:N). The attacker must have at least a user-level privilege (PR:L), but no further authentication or social engineering is needed. The impact is primarily on availability, with a high impact on system operations due to resource exhaustion. The vulnerability has been addressed and fixed in File Station 5 version 5.5.6.4847 and later. No known exploits are currently reported in the wild, but the presence of a fix indicates the vendor's recognition of the risk. Given the nature of the vulnerability, it is a form of resource exhaustion attack that could disrupt business operations relying on QNAP NAS devices for file storage and sharing.

Potential Impact

For European organizations, the impact of CVE-2025-22484 can be significant, especially for those relying on QNAP NAS devices for critical file storage, backup, and sharing functions. The denial of service caused by resource exhaustion could disrupt access to important data and applications, leading to operational downtime and potential data unavailability. This can affect sectors such as finance, healthcare, manufacturing, and public administration, where continuous access to data is crucial. Additionally, organizations with remote or hybrid work environments that depend on NAS devices for file access may experience productivity losses. The requirement for an attacker to have a user account means insider threats or compromised credentials pose a particular risk. The vulnerability could also be leveraged as part of a multi-stage attack to degrade system performance or as a distraction while other attacks are conducted. Although no exploits are currently known in the wild, the high CVSS score and ease of exploitation warrant immediate attention to prevent potential future attacks.

Mitigation Recommendations

European organizations should prioritize updating File Station 5 to version 5.5.6.4847 or later to remediate this vulnerability. Beyond patching, organizations should implement strict access controls and monitor user accounts on QNAP NAS devices to detect any unauthorized or suspicious activity. Employing multi-factor authentication (MFA) can reduce the risk of credential compromise. Network segmentation should be used to limit access to NAS devices only to trusted users and systems. Additionally, monitoring resource usage on NAS devices can help detect early signs of resource exhaustion attacks. Implementing rate limiting or throttling mechanisms, if supported by the device, can mitigate the impact of resource allocation abuse. Regular audits of user privileges and removal of unnecessary accounts will reduce the attack surface. Finally, organizations should maintain up-to-date backups and have incident response plans tailored to NAS device disruptions.

Need more detailed analysis?Get Pro

Technical Details

Data Version
5.1
Assigner Short Name
qnap
Date Reserved
2025-01-07T06:55:33.250Z
Cvss Version
4.0
State
PUBLISHED

Threat ID: 6843110571f4d251b5d0a5ca

Added to database: 6/6/2025, 4:02:13 PM

Last enriched: 7/8/2025, 5:26:13 AM

Last updated: 8/14/2025, 1:40:07 PM

Views: 18

Actions

PRO

Updates to AI analysis are available only with a Pro account. Contact root@offseq.com for access.

Please log in to the Console to use AI analysis features.

Need enhanced features?

Contact root@offseq.com for Pro access with improved analysis and higher rate limits.

Latest Threats