CVE-2025-54162 is a medium-severity path traversal vulnerability affecting QNAP Systems Inc. 's File Station 5 version 5.5.x. An attacker with administrator privileges can exploit this flaw to read arbitrary files outside the intended directory scope, potentially exposing sensitive system data. The vulnerability does not require user interaction and has no known exploits in the wild as of now. It has been fixed in File Station 5 version 5.5.6.5068 and later.
CVE-2025-54163 is a NULL pointer dereference vulnerability in QNAP Systems Inc. 's File Station 5 version 5.5.x. Exploitation requires an attacker to have an administrator account, after which they can cause a denial-of-service (DoS) condition by triggering the vulnerability. The issue has been addressed in File Station 5 version 5.5.6.5166 and later. The CVSS 4.
CVE-2025-54169 is an out-of-bounds read vulnerability in QNAP Systems Inc. 's File Station 5, specifically affecting version 5.5.x. A remote attacker with a valid user account can exploit this flaw to read sensitive data beyond intended memory boundaries, potentially exposing secret information. The vulnerability does not require user interaction and has a CVSS 4.9 (medium) severity score. It has been fixed in File Station 5 version 5.5.6.
CVE-2025-54170 is an out-of-bounds read vulnerability in QNAP Systems Inc. 's Qsync Central version 5.0.x.x. A remote attacker with a valid user account can exploit this flaw to read secret data without requiring user interaction or elevated privileges beyond the user account. The vulnerability has a medium severity with a CVSS score of 4.9 and was fixed in version 5.0.0.
CVE-2025-57707 is a low-severity vulnerability in QNAP Systems Inc. 's File Station 5, specifically version 5.5.x, involving improper neutralization of directives in statically saved code (Static Code Injection). A remote attacker with a valid user account can exploit this flaw to access restricted data or files. The vulnerability requires low privileges (a user account) and user interaction but does not allow privilege escalation or code execution. No known exploits are currently in the wild, and the issue has been fixed in File Station 5 version 5.5.6.5166 and later.
CVE-2025-57708 is a resource allocation vulnerability in QNAP Systems Inc. 's Qsync Central version 5.0.x.x. A remote attacker with a valid user account can exploit this flaw to exhaust shared resources without limits or throttling, potentially causing denial of service for other systems or processes. The vulnerability is classified under CWE-770, indicating improper management of resource allocation. It has a low CVSS 4.0 score of 2.3 due to the requirement of authenticated access and limited impact on confidentiality and integrity.
CVE-2025-57709 is a buffer overflow vulnerability in QNAP Systems Inc. 's Qsync Central version 5.0.x.x. A remote attacker with a valid user account can exploit this flaw to modify memory or crash processes without requiring user interaction. The vulnerability has a low CVSS score of 1.3, indicating limited impact and ease of exploitation. It was fixed in Qsync Central version 5.0.
CVE-2025-57710 is a resource allocation vulnerability in QNAP Systems Inc. 's Qsync Central version 5.0.x.x. A remote attacker with administrator privileges can exploit this flaw to exhaust specific system resources without limits or throttling, causing denial of service to other systems, applications, or processes relying on the same resources. The vulnerability does not require user interaction but does require high privileges (administrator access). It has a CVSS 4.0 base score of 3.6, indicating low severity.
CVE-2025-57711 is a resource allocation vulnerability in QNAP Systems Inc. 's Qsync Central version 5.0.x.x that allows a remote attacker with administrator privileges to exhaust resources without limits or throttling, potentially denying access to those resources for other systems or processes. The vulnerability is classified under CWE-770 and has a CVSS 4.0 base score of 3.6, indicating low severity. Exploitation requires high privileges (administrator access) and does not require user interaction. The issue was fixed in Qsync Central version 5.
CVE-2025-57713 is a low-severity weak authentication vulnerability affecting QNAP Systems Inc. 's File Station 5, specifically versions 5.5.x prior to 5.5.6.5166. Remote attackers can exploit this flaw without privileges or user interaction to gain limited sensitive information. The vulnerability is classified under CWE-1390, indicating a weakness in authentication mechanisms. Although the CVSS score is low (1.
CVE-2025-58466 is a low-severity vulnerability in QNAP's QTS operating system caused by the use of an uninitialized variable (CWE-457). It affects QTS version 5.2.x and allows a remote attacker with administrator privileges to cause denial of service or potentially alter control flow in unexpected ways. The vulnerability requires an attacker to already have admin-level access, does not require user interaction, and has no known exploits in the wild. QNAP has released fixes in QTS 5.2.8.3332 and later versions. While the CVSS score is low (1.
CVE-2025-58467 is a relative path traversal vulnerability in QNAP Systems Inc. 's Qsync Central version 5.0.x.x. An attacker with a valid user account can exploit this flaw to access files outside the intended directory scope, potentially reading sensitive system or user data. The vulnerability requires no user interaction but does require authenticated access. It has a low CVSS 4.0 score of 1.3, reflecting limited impact and ease of exploitation.
CVE-2025-58470 is a path traversal vulnerability in QNAP Systems Inc. 's Qsync Central product affecting version 5.0.x.x. An attacker with a valid user account can exploit this flaw to read unauthorized files on the system, potentially exposing sensitive data. The vulnerability does not require user interaction and has a low CVSS score of 1.3, indicating limited impact and ease of exploitation. The issue was fixed in Qsync Central version 5.0.
CVE-2025-58471 is a resource allocation vulnerability in QNAP Systems Inc. 's Qsync Central version 5.2.x.x. A remote attacker with administrator privileges can exploit this flaw to exhaust resources without limits or throttling, potentially denying access to those resources for other systems, applications, or processes. The vulnerability does not require user interaction and has a low CVSS score of 1.2, indicating limited impact and ease of exploitation. It has been fixed in Qsync Central version 5.2.
CVE-2025-58472 is a low-severity NULL pointer dereference vulnerability in QNAP Systems Inc. 's Qsync Central version 5.0.x.x. An attacker with administrator privileges can exploit this flaw to cause a denial-of-service (DoS) condition, crashing or disrupting the service. The vulnerability does not require user interaction and has a low CVSS score of 1.2, reflecting limited impact and exploitability. The issue has been fixed in Qsync Central version 5.0.
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.
We have already fixed the vulnerability in the following version:
QuTS hero h5.3.2.3354 build 20251225 and later
CVE-2025-62853 is a medium-severity path traversal vulnerability in QNAP Systems Inc. 's File Station 5, specifically affecting versions 5.5.x prior to 5.5.6.5166. An attacker with a valid user account can exploit this flaw to read arbitrary files on the system, potentially exposing sensitive data. The vulnerability does not require user interaction and can be exploited remotely with low attack complexity, but it does require authenticated access. No known exploits are currently reported in the wild.
CVE-2025-62854 is an uncontrolled resource consumption vulnerability in QNAP Systems Inc. 's File Station 5, affecting versions 5.5.x prior to 5.5.6.5190. A remote attacker with a valid user account can exploit this flaw to launch a denial-of-service (DoS) attack by exhausting system resources. The vulnerability requires no user interaction but does require authenticated access with at least user-level privileges. The CVSS 4.
A path traversal vulnerability has been reported to affect File Station 5. If a local attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data.
We have already fixed the vulnerability in the following version:
File Station 5 5.5.6.5190 and later
CVE-2025-62856 is a path traversal vulnerability in QNAP Systems Inc. 's File Station 5, affecting versions 5.5.x prior to 5.5.6.5190. A local attacker with administrator privileges can exploit this flaw to access files outside the intended directory scope, potentially exposing sensitive system or user data. The vulnerability does not require user interaction and has a low CVSS score of 1.3, reflecting limited impact and ease of exploitation.
