CVE-2025-29872: Qnap File Station DOS Vulnerability

CVE-2025-29872 Overview

CVE-2025-29872 is an allocation of resources without limits or throttling vulnerability [CWE-770] affecting QNAP File Station 5. An authenticated remote attacker with a valid user account can exploit the flaw to exhaust resources and prevent other systems, applications, or processes from accessing the same resource type. The condition results in a denial of service against the File Station service running on affected QNAP Network Attached Storage (NAS) appliances.

QNAP addressed the issue in File Station 5 version 5.5.6.4847 and later. The vulnerability is tracked under QNAP advisory QSA-25-16.

Critical Impact
An authenticated remote attacker can trigger resource exhaustion on QNAP NAS devices running vulnerable File Station 5 builds, blocking legitimate access to file services.

Affected Products

QNAP File Station 5 versions prior to 5.5.6.4847
QNAP NAS appliances with File Station 5 installed
Deployments exposing File Station to authenticated remote users

Discovery Timeline

2025-06-06 - CVE-2025-29872 published to NVD
2025-06-18 - Last updated in NVD database

Technical Details for CVE-2025-29872

Vulnerability Analysis

The vulnerability is classified as Allocation of Resources Without Limits or Throttling [CWE-770]. File Station 5 fails to enforce upper bounds on resource consumption tied to authenticated user actions. An attacker holding a valid account can repeatedly invoke functionality that allocates memory, file handles, threads, or connection state without applying quotas or rate limits.

Sustained abuse leads to resource starvation within the File Station process. Other systems, applications, or processes that depend on the same resource pool lose the ability to acquire it. The result is a denial of service condition impacting file management functions on the NAS.

The attack vector is network-based and requires low privileges. No user interaction is needed. The impact is limited to availability, with confidentiality and integrity unaffected. The EPSS score is 0.389% with a percentile of 60.1, indicating a low statistical likelihood of broad exploitation in the near term.

Root Cause

The root cause is missing throttling and quota enforcement in File Station 5 request handlers. The application accepts and processes resource-allocating operations from authenticated users without checking cumulative consumption against per-user or per-session limits. This permits unbounded growth in resource use until system or process limits are reached.

Attack Vector

Exploitation requires an authenticated session with low-privilege credentials on the target QNAP appliance. The attacker issues repeated or concurrent requests to File Station endpoints that allocate server-side resources. Because no throttling logic constrains these calls, the attacker drives the service toward exhaustion. Devices exposed to untrusted networks or shared by many users carry the highest exposure.

No public proof-of-concept exploit code is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the QNAP Security Advisory QSA-25-16 for vendor-provided technical context.

Detection Methods for CVE-2025-29872

Indicators of Compromise

Sudden spikes in File Station memory, CPU, or thread consumption without a corresponding increase in legitimate user activity
File Station service slowdowns, timeouts, or crashes affecting concurrent NAS users
High volumes of repeated authenticated API calls from a single account to File Station endpoints

Detection Strategies

Monitor File Station process metrics for sustained resource growth tied to a specific authenticated session
Correlate QNAP authentication logs with File Station request volume to identify accounts issuing abnormal request rates
Alert on File Station service restarts, crash dumps, or out-of-memory conditions on QNAP appliances

Monitoring Recommendations

Forward QNAP system, access, and File Station logs to a centralized SIEM or data lake for correlation
Baseline normal File Station request patterns per user account and alert on statistical deviations
Track NAS resource utilization (memory, file descriptors, active sessions) and trigger thresholds for early warning

How to Mitigate CVE-2025-29872

Immediate Actions Required

Upgrade File Station 5 to version 5.5.6.4847 or later on all affected QNAP NAS devices
Audit user accounts on QNAP appliances and remove unused or unnecessary accounts that could be abused
Enforce strong password policies and multi-factor authentication on QNAP user logins to reduce account compromise risk

Patch Information

QNAP has fixed the vulnerability in File Station 5 version 5.5.6.4847 and later. Administrators should apply the update via the QNAP App Center or download it from the official QNAP site. Refer to the QNAP Security Advisory QSA-25-16 for complete remediation guidance.

Workarounds

Restrict File Station access to trusted internal networks using firewall rules or QNAP access control lists
Disable File Station on appliances where it is not required until the patch is applied
Limit the number of accounts authorized to use File Station and review their session activity regularly

bash

# Example: restrict File Station network exposure via QNAP firewall CLI
# (apply only to management interfaces under administrator control)
qfirewall add --service file_station --source 10.0.0.0/24 --action allow
qfirewall add --service file_station --source 0.0.0.0/0 --action deny