A NULL pointer dereference in QNAP File Station 5 has been identified. This flaw allows a distant attacker who can authenticate to a user account to trigger a crash that results in a denial‑of‑service condition for the affected service, disrupting normal file station operations. The weakness is a classic null reference usage error (CWE‑476) and does not directly lead to data compromise or privilege escalation.

The vulnerability is present in QNAP Systems Inc. File Station 5 deployments running versions earlier than 5.5.6.5243. The affected product is listed under the vendor‑product pair QNAP File Station 5, with affected CPE cpe:2.3:a:qnap:file_station:*.*.*.*.*.*.*.*.*.

The CVSS score of 5.3 indicates a moderate impact, and the EPSS score of less than 1% demonstrates a very low likelihood of exploitation in the wild. The flaw is not listed in the CISA KEV catalog, so no known large‑scale attacks have reported exploitation. Because the attacker must first obtain a valid user account, the attack vector is considered remote authenticated access, limiting the attack surface. Overall, while the risk is moderate, the practical exploitation probability remains low.