A NULL pointer dereference flaw exists in QNAP File Station 5’s utilRequest.cgi component; a remote attacker who has gained a user account can trigger the vulnerability, causing the File Station service to become unresponsive and effectively denying legitimate users access. This weakness is a classic pointer misuse described by CWE‑476.

The issue affects all QNAP File Station 5 installations running versions prior to 5.5.6.5243; the vendor released a fix in the 5.5.6.5243 build and later releases.

With a CVSS score of 5.3, the vulnerability is considered moderate severity. The EPSS score of less than 1 % indicates a low probability of exploitation in the wild, and the vulnerability is not listed in CISA KEV. The likely attack requires an authenticated user session; an attacker who can obtain or guess valid user credentials could then exploit the NULL dereference to crash the service and cause a denial‑of‑service condition.