CVE-2026-24720: File Station DoS Vulnerability

CVE-2026-24720 Overview

CVE-2026-24720 is a resource allocation without limits or throttling vulnerability [CWE-770] affecting QNAP File Station 6. An authenticated remote attacker can exploit this flaw to exhaust system resources and prevent other systems, applications, or processes from accessing the same resource type. The vulnerability requires a valid user account, which lowers the barrier for exploitation in environments where credentials are weak or widely distributed. QNAP has addressed the issue in File Station 5 version 5.5.6.5243 and later.

Critical Impact

Authenticated remote attackers can trigger resource exhaustion in File Station 6, disrupting access to shared resources for legitimate users and dependent services.

Affected Products

• QNAP File Station 6 (versions prior to the fixed release)
• QNAP NAS appliances running vulnerable File Station builds
• Environments where File Station shares resources with other QNAP applications

Discovery Timeline

• 2026-06-10 - CVE-2026-24720 published to NVD
• 2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-24720

Vulnerability Analysis

The vulnerability stems from missing throttling and quota enforcement on resource allocation within File Station 6. When an authenticated user issues operations that consume shared resources, the application does not impose upper bounds on consumption. An attacker with a low-privilege account can repeatedly request these operations to monopolize the resource pool. Legitimate users and co-resident services that depend on the same resource type then experience degraded availability or full denial of service. The flaw is categorized under [CWE-770] (Allocation of Resources Without Limits or Throttling), a common root cause of application-layer denial of service conditions.

Root Cause

The root cause is the absence of rate limiting, per-user quotas, and resource ceilings on operations exposed by File Station 6. The application accepts and processes requests without tracking cumulative consumption per session or per account. There is no enforcement layer that rejects requests once a threshold is reached, so attackers can drive resource use unbounded.

Attack Vector

The attack is performed remotely over the network against the File Station web interface. The attacker must first authenticate using a valid account, but no elevated privileges are required. After authentication, the attacker issues a high volume of resource-consuming requests against the vulnerable endpoints. Successful exploitation impacts availability of the targeted resource type. There is no confidentiality or integrity impact and no user interaction is required beyond the initial login.

No verified exploit code is publicly available. Refer to the QNAP Security Advisory QSA-26 for vendor-supplied technical detail.

Detection Methods for CVE-2026-24720

Indicators of Compromise

• Sustained spikes in CPU, memory, or file handle usage on the QNAP appliance tied to File Station processes
• Repeated File Station API requests originating from a single authenticated session or source IP
• User reports of File Station timeouts, slow responses, or failure to access shares

Detection Strategies

• Monitor File Station access logs for unusually high request rates from individual user accounts
• Correlate authentication events with subsequent resource consumption to identify abusive sessions
• Alert on QNAP system health metrics breaching baselines, especially when associated with File Station workloads

Monitoring Recommendations

• Forward QNAP system and application logs to a centralized log platform for retention and correlation
• Track per-user request counts and resource consumption trends across the File Station service
• Establish alerting thresholds for sustained anomalous activity from any single authenticated user

How to Mitigate CVE-2026-24720

Immediate Actions Required

• Upgrade File Station to version 5.5.6.5243 or later as specified in the QNAP advisory
• Review and disable unused or stale File Station user accounts to reduce the authenticated attack surface
• Enforce strong password policies and multi-factor authentication on all QNAP accounts

Patch Information

QNAP has released a fix in File Station version 5.5.6.5243 and later. Administrators should apply the update through the QNAP App Center or download it directly from the vendor. Full details are available in the QNAP Security Advisory QSA-26.

Workarounds

• Restrict File Station access to trusted networks using firewall rules or QNAP's built-in access control
• Limit the number of accounts with File Station permissions until the patch can be applied
• Place QNAP appliances behind a VPN to prevent direct internet exposure of the File Station interface