CVE-2025-22484: File Station 5 DoS Vulnerability

CVE-2025-22484 Overview

CVE-2025-22484 is a resource allocation vulnerability affecting QNAP File Station 5. The flaw stems from missing limits or throttling on resource allocation [CWE-770]. A remote attacker who obtains a valid user account can exploit the issue to exhaust shared resources. This prevents other systems, applications, or processes from accessing the same resource type, producing a denial-of-service condition. QNAP addressed the issue in File Station 5 version 5.5.6.4847 and later, as documented in QNAP Security Advisory QSA-25-16.

Critical Impact
Authenticated remote attackers can exhaust resources on the File Station 5 host, denying service to legitimate users and dependent applications.

Affected Products

QNAP File Station 5 prior to 5.5.6.4847
QNAP NAS appliances running vulnerable File Station 5 builds
Environments exposing File Station 5 to authenticated remote users

Discovery Timeline

2025-06-06 - CVE-2025-22484 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-22484

Vulnerability Analysis

The vulnerability is classified under [CWE-770]: Allocation of Resources Without Limits or Throttling. File Station 5 does not enforce upper bounds on a resource that authenticated users can request. An attacker who controls a low-privilege account can repeatedly invoke the affected operation to consume the resource until legitimate processes cannot acquire it. The EPSS score of 0.335% indicates current exploitation likelihood is low, but authenticated access lowers the practical barrier in multi-user NAS deployments.

Root Cause

File Station 5 lacks throttling and quota enforcement on a specific resource path reachable through its authenticated interface. Each request allocates additional resources without verifying cumulative consumption per user or session. The absence of rate limiting and bounded allocation allows a single account to monopolize the resource.

Attack Vector

Exploitation requires network access and valid credentials, but no user interaction. An attacker authenticates to File Station 5 and issues a sustained sequence of requests that allocate the unbounded resource. The targeted resource becomes unavailable to other system components, degrading or halting File Station functionality and dependent services on the NAS. QNAP has not published exploitation details, and no public proof of concept is available. See the QNAP Security Advisory QSA-25-16 for vendor-confirmed details.

Detection Methods for CVE-2025-22484

Indicators of Compromise

Sustained high-volume requests from a single authenticated user to File Station 5 endpoints
Abnormal spikes in memory, file handle, thread, or connection counts on the QNAP host
File Station 5 errors indicating resource allocation failures or service unavailability
Legitimate users reporting inability to access File Station while one account remains active

Detection Strategies

Baseline normal File Station 5 request rates per account, then alert on deviations
Correlate authentication logs with resource utilization metrics on the NAS
Monitor QNAP system logs for repeated allocation failures or service restarts

Monitoring Recommendations

Track per-user session counts and request frequency against File Station 5
Enable QNAP notification center alerts for CPU, memory, and connection thresholds
Forward NAS logs to a centralized SIEM for cross-host correlation and retention

How to Mitigate CVE-2025-22484

Immediate Actions Required

Upgrade File Station 5 to version 5.5.6.4847 or later through the QNAP App Center
Audit existing File Station 5 user accounts and remove or disable unused credentials
Restrict File Station 5 exposure to trusted networks and require VPN for remote access
Enforce strong, unique passwords and enable two-factor authentication on all NAS accounts

Patch Information

QNAP fixed the vulnerability in File Station 5 version 5.5.6.4847 and later. Apply the update through the QNAP App Center or download it from the QNAP download center. Refer to QNAP Security Advisory QSA-25-16 for vendor guidance and confirmation of fixed builds.

Workarounds

Disable File Station 5 until the patched version is deployed if immediate upgrade is not possible
Block external access to File Station 5 ports at the perimeter firewall
Limit File Station 5 access to a small set of administrative accounts on trusted IP ranges

bash

# Verify installed File Station 5 version on QNAP via SSH
qpkg_cli --list | grep -i "File Station 5"

# Expected patched output should show version 5.5.6.4847 or later