CVE-2025-29873: Qnap File Station DOS Vulnerability

CVE-2025-29873 Overview

CVE-2025-29873 is a NULL pointer dereference vulnerability [CWE-476] affecting QNAP File Station 5. A remote authenticated attacker with a valid user account can trigger the flaw to crash the service and cause a denial-of-service (DoS) condition. QNAP disclosed the issue in security advisory QSA-25-16 and shipped a fix in File Station 5 version 5.5.6.4847 and later. The vulnerability requires network access and low privileges, but no user interaction. Exploitation impacts availability of the File Station component without affecting confidentiality or integrity of stored data.

Critical Impact
An authenticated remote attacker can crash QNAP File Station 5, disrupting file access services on affected NAS appliances.

Affected Products

QNAP File Station 5 versions prior to 5.5.6.4847
QNAP NAS appliances running vulnerable File Station 5 builds
Deployments exposing File Station to authenticated remote users

Discovery Timeline

2025-06-06 - CVE-2025-29873 published to NVD
2025-06-18 - Last updated in NVD database

Technical Details for CVE-2025-29873

Vulnerability Analysis

The flaw is a NULL pointer dereference within QNAP File Station 5. The application dereferences a pointer that was never initialized or was returned as NULL from an upstream operation without a preceding validity check. When the affected code path executes, the process accesses memory at address zero and terminates, halting File Station functionality.

The vulnerability is reachable over the network by an attacker holding a valid File Station user account. No user interaction is required to trigger the condition. Exploitation impacts availability only — there is no path to code execution or data disclosure described in the QNAP advisory. The EPSS probability is 0.385%, reflecting low observed exploit interest at the time of publication.

Root Cause

The root cause is missing pointer validation [CWE-476] within a File Station request handler. The code path consumes a pointer returned by an internal allocation or lookup routine and does not verify the value is non-NULL before dereferencing it. A crafted request from an authenticated session forces the unsafe path.

Attack Vector

The attack vector is network-based. An attacker authenticates to the QNAP appliance using a valid low-privilege account, then issues a request that drives File Station into the unsafe code path. The targeted process crashes and File Station becomes unavailable until restarted. QNAP has not published proof-of-concept details. See the QNAP Security Advisory QSA-25-16 for vendor guidance.

Detection Methods for CVE-2025-29873

Indicators of Compromise

Unexpected crashes or restarts of the File Station 5 service process on QNAP NAS appliances
Authenticated session activity from low-privilege accounts immediately preceding a File Station outage
Repeated client disconnections from File Station web and API endpoints

Detection Strategies

Monitor QNAP system logs for File Station service termination, segmentation faults, or watchdog-triggered restarts
Correlate File Station crash events with authenticated HTTP requests in access logs to identify the triggering session
Track anomalous request patterns from user accounts that do not normally interact with File Station

Monitoring Recommendations

Enable verbose logging on File Station and forward NAS logs to a centralized log platform for retention and analysis
Alert on repeated File Station process restarts within a short time window as a DoS indicator
Audit File Station user accounts and disable or rotate credentials for accounts no longer in active use

How to Mitigate CVE-2025-29873

Immediate Actions Required

Upgrade File Station 5 to version 5.5.6.4847 or later on all affected QNAP appliances
Restrict File Station access to trusted networks using firewall rules or QNAP access controls
Review and remove unnecessary File Station user accounts to reduce the authenticated attack surface
Enforce strong, unique passwords and enable two-step verification for all QNAP accounts

Patch Information

QNAP fixed CVE-2025-29873 in File Station 5 version 5.5.6.4847 and later. Administrators can update through the App Center on the QNAP appliance or download the package from QNAP. Refer to QNAP Security Advisory QSA-25-16 for the official remediation notice and download instructions.

Workarounds

Block external access to File Station web and API ports at the network perimeter until patching is complete
Limit File Station to administrator accounts only, removing access for standard users where feasible
Place QNAP appliances behind a VPN so File Station is not reachable from untrusted networks

bash

# Update File Station 5 via QNAP App Center (administrator session)
# 1. Sign in to QTS as an administrator
# 2. Open App Center > Installed Apps
# 3. Locate File Station 5 and click Update
# 4. Confirm the installed version is 5.5.6.4847 or later
qpkg_cli --list | grep -i "File Station"