QNAP Security Advisory on Multiple Resolved Vulnerabilities in File Station 5

Qnap Systems, Inc. had published a security advisory concerning resolved vulnerabilities in File Station 5 App for its NAS.

Release date: August 26, 2025
CVE identifier: CVE-2025-29901 | CVE-2025-47206
Affected products: File Station 5 version 5.5.x
Severity: Moderate
Status: Resolved

Summary
Multiple vulnerabilies have been reported to affect File Station 5:

• CVE-2025-29901: NULL pointer deference vulnerability. If a remote attacker gains access to a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.
• CVE-2025-47206: Out of bounds write vulnerability. If a remote attacker gains access to a user account, they can then exploit the vulnerability to modify or corrupt memory.

The company have already fixed the vulnerabilities in following version:

Recommendation
To fix the vulnerabilities, the firm recommend updating File Station 5 to the latest version.

Updating File Station 5

1. Log on to QTS or QuTS hero as an administrator.
2. Open App Center and then click
3. A search box appears.
4. Type ‘File Station 5’ and then press ENTER.
   File Station 5 appears in the search results.
5. Click Update.
   A confirmation message appears.
   Note: The Update button is not available if your File Station 5 is already up to date.
6. Click OK.
   The system updates the application.

  Attachment

• CVE-2025-29901.json
• CVE-2025-47206.json

Acknowledgements: Coral

Revision History:
V1.0 (August 26, 2025) – Published