CVE-2025-47207: Qnap File Station DOS Vulnerability

CVE-2025-47207 Overview

CVE-2025-47207 is a NULL pointer dereference vulnerability [CWE-476] affecting QNAP File Station. An authenticated remote attacker with a valid user account can trigger the flaw to cause a denial-of-service (DoS) condition on the affected service. QNAP has addressed the issue in File Station 5 version 5.5.6.5018 and later. The vulnerability is tracked under QNAP Security Advisory QSA-25-38 and carries a CVSS 4.0 base score of 5.3.

Critical Impact
Authenticated remote attackers can crash QNAP File Station, disrupting file management services on affected NAS appliances.

Affected Products

QNAP File Station 5 versions prior to 5.5.6.5018
QNAP NAS devices with vulnerable File Station installed
Deployments exposing File Station to networked user access

Discovery Timeline

2025-11-07 - CVE-2025-47207 published to NVD
2026-06-17 - Last updated in NVD database
Vendor advisory: QNAP Security Advisory QSA-25-38

Technical Details for CVE-2025-47207

Vulnerability Analysis

The vulnerability is a NULL pointer dereference in QNAP File Station. When an authenticated user submits a specific request to the File Station service, code paths dereference a pointer that was never initialized or validated. The dereference crashes the handling process, interrupting File Station availability for all users. Because exploitation only requires low-privilege authenticated access over the network, any valid NAS user account is sufficient to disrupt the service.

The impact is limited to availability. The flaw does not expose confidentiality or integrity, and it does not grant code execution or privilege escalation. However, repeated exploitation can produce sustained denial of service against the file management plane of the NAS.

Root Cause

The root cause is improper validation of a pointer before use, categorized under [CWE-476] NULL Pointer Dereference. A request-handling routine in File Station accesses an object or structure field without first confirming the pointer is non-null. The resulting segmentation fault terminates the worker handling the request. QNAP has not published the vulnerable function name or request parameter in the public advisory.

Attack Vector

Exploitation requires network access to the File Station web interface and valid user credentials. No user interaction is required beyond the attacker's own authenticated session. An adversary who has already obtained an unprivileged account, through credential reuse, phishing, or weak passwords, can send a crafted request to the File Station endpoint and cause the service to crash. See the QNAP Security Advisory QSA-25-38 for vendor guidance.

Detection Methods for CVE-2025-47207

Indicators of Compromise

Unexpected crashes or restarts of the File Station service on QNAP NAS devices
Segmentation fault entries in NAS system logs tied to File Station worker processes
Repeated authenticated HTTP requests from a single account preceding a service outage
File Station unavailability reports from legitimate users while the NAS otherwise remains reachable

Detection Strategies

Monitor QNAP system and application logs for abnormal termination of File Station processes
Correlate authenticated session activity with File Station restart events to identify a triggering account
Alert on repeated 5xx responses or sudden session drops from the File Station web endpoint

Monitoring Recommendations

Forward QNAP syslog data to a centralized logging platform for retention and correlation
Track File Station version strings across the NAS fleet to confirm patched builds are deployed
Baseline normal request patterns to File Station so crash-inducing anomalies stand out

How to Mitigate CVE-2025-47207

Immediate Actions Required

Upgrade File Station 5 to version 5.5.6.5018 or later on all affected QNAP NAS devices
Audit NAS user accounts and remove or disable unused, shared, or weak credentials
Restrict File Station exposure to trusted networks and require VPN access for remote use
Enforce multi-factor authentication for all NAS accounts that can reach File Station

Patch Information

QNAP has fixed the vulnerability in File Station 5 version 5.5.6.5018 and later. Administrators should install the patched release through the QNAP App Center or by downloading the update directly from QNAP. Full remediation details are available in QNAP Security Advisory QSA-25-38.

Workarounds

Limit File Station access to administrative users until the patch can be applied
Place the NAS management interface behind a firewall or reverse proxy with IP allowlisting
Disable File Station temporarily on NAS devices that do not require it
Rotate credentials for any accounts that may have been exposed or reused externally

bash

# Verify installed File Station version on QNAP NAS
qpkg_cli --list | grep -i "File Station"

# Restrict File Station web access by source IP via QuFirewall
# (configure through QuFirewall UI: Settings > Profiles > Allow List)