CVE-2025-53409
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
An allocation of resources without limits or throttling vulnerability in File Station 5 allows a remote attacker with a user account to exhaust resources. This can prevent other systems, applications, or processes from accessing the same type of resource.
Risk Assessment
An attacker with a user account can cause resource exhaustion and disrupt services on the NAS device. This may lead to denial of access to resources for other systems and users.
Recommendation
Upgrade File Station 5 to version 5.5.6.5018 or later. Limit the number of user accounts and monitor for unusual resource consumption.
Other vulnerabilities in File Station 5
See all- CVE-2026-26241Critical
Buffer overflow in File Station 5 allows a remote attacker to modify memory or crash processes. The vulnerability is fixed in version 5.5.6.5243 and later.
- CVE-2026-26240Critical
Buffer overflow in File Station 5 allows a remote attacker to modify memory or crash processes. The vulnerability is fixed in version 5.5.6.5243 and later.
- CVE-2026-24723Medium
A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.
- CVE-2026-24722Medium
A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.
- CVE-2026-24721Medium
A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.
- CVE-2026-26239High
A buffer overflow vulnerability in File Station 5. A remote attacker with a user account can exploit this vulnerability to modify memory or crash processes. The vulnerability has been fixed in File Station 5 version 5.5.6.5208 and later.
- CVE-2026-24724High
An incorrect authorization vulnerability in File Station 6 allows a remote attacker who gains a user account to bypass intended access restrictions. The issue is fixed in File Station 5 version 5.5.6.5243 and later.
- CVE-2026-24720Medium
File Station 6 has a resource allocation without limits vulnerability. A remote attacker who gains a user account can exploit it to prevent other systems, applications, or processes from accessing the same type of resource.
- CVE-2026-22899Medium
File Station 6 has a NULL pointer dereference vulnerability. A remote attacker who gains a user account can exploit it to launch a denial-of-service (DoS) attack.
- CVE-2025-57706Medium
A cross-site scripting (XSS) vulnerability has been reported in File Station 5. A remote attacker with a user account can exploit it to bypass security mechanisms or read application data.
Original NVD description (English source)
An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5018 and later
Vulnerability data from NVD (NIST) · CISA KEV · EPSS

