CVE-2025-22490: QNAP File Station DoS Vulnerability

CVE-2025-22490 Overview

CVE-2025-22490 is a NULL pointer dereference vulnerability [CWE-476] affecting QNAP File Station 5. An authenticated remote attacker can trigger the flaw to crash the service and cause a denial-of-service (DoS) condition. Exploitation requires a valid user account but no user interaction. QNAP has addressed the issue in File Station 5 version 5.5.6.4847 and later through security advisory QSA-25-16. The vulnerability impacts availability but does not expose data confidentiality or integrity.

Critical Impact
Authenticated remote attackers can crash QNAP File Station 5, disrupting file management services on affected NAS devices.

Affected Products

QNAP File Station 5 versions prior to 5.5.6.4847
QNAP NAS devices running vulnerable File Station 5 builds
Deployments exposing File Station to authenticated remote users

Discovery Timeline

2025-06-06 - CVE-2025-22490 published to NVD
2025-06-18 - Last updated in NVD database

Technical Details for CVE-2025-22490

Vulnerability Analysis

The vulnerability is a NULL pointer dereference [CWE-476] in QNAP File Station 5. The application dereferences a pointer that has not been validated for a non-NULL value. When the dereference occurs, the process accesses an invalid memory address and crashes. This crash terminates the File Station service and disrupts file management operations on the NAS. The flaw requires an authenticated session but no elevated privileges. Exploitation does not yield code execution or data disclosure, but it removes access to a core NAS function.

Root Cause

The root cause is missing validation of a pointer before dereference inside File Station 5 request handling logic. When a crafted request reaches the affected code path, the unchecked pointer resolves to NULL and triggers a process fault. QNAP has not published low-level technical details beyond advisory QSA-25-16.

Attack Vector

The attack vector is network-based. An attacker authenticates to the QNAP device using any valid user account, then issues a crafted request to the File Station 5 service. The request reaches the vulnerable code path and forces the NULL dereference. No user interaction is required on the victim side. The result is a denial-of-service condition affecting File Station availability.

No public proof-of-concept code or exploit is currently available. Technical details are described in the QNAP Security Advisory QSA-25-16.

Detection Methods for CVE-2025-22490

Indicators of Compromise

Unexpected crashes or restarts of the File Station 5 service on QNAP NAS devices
Repeated authenticated requests from a single source to File Station endpoints prior to a service crash
Error entries in QNAP system logs referencing File Station process termination

Detection Strategies

Monitor QNAP system event logs for File Station service faults and abnormal terminations
Correlate authentication events with subsequent service crashes to identify suspect user accounts
Track HTTP request volume and patterns directed at File Station URLs from individual user sessions

Monitoring Recommendations

Forward QNAP NAS logs to a centralized SIEM and alert on File Station crash signatures
Baseline normal File Station request rates per authenticated user and alert on deviations
Review user account inventories for unused or stale accounts that could be abused for authenticated DoS

How to Mitigate CVE-2025-22490

Immediate Actions Required

Upgrade QNAP File Station 5 to version 5.5.6.4847 or later as specified in advisory QSA-25-16
Audit and disable unused user accounts that could be leveraged for authenticated exploitation
Restrict network exposure of QNAP management interfaces to trusted networks or VPN clients

Patch Information

QNAP has fixed CVE-2025-22490 in File Station 5 version 5.5.6.4847 and later. Administrators should apply the update through the QNAP App Center or by following the steps in the QNAP Security Advisory QSA-25-16.

Workarounds

Limit File Station access to administrative users only until the patch is applied
Place QNAP devices behind a firewall and block File Station ports from untrusted networks
Enforce strong password policies and multi-factor authentication to reduce the risk of account compromise

bash

# Configuration example
# Update File Station 5 via QNAP App Center CLI on the NAS
qpkg_cli --upgrade FileStation5
# Verify installed version
qpkg_cli --list | grep -i FileStation5