CVE-2024-48864
Published: 07 March 2025
Summary
CVE-2024-48864 is a critical-severity Files or Directories Accessible to External Parties (CWE-552) vulnerability in Qnap File Station. Its CVSS base score is 9.1 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 37.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-22 (Publicly Accessible Content) and AC-3 (Access Enforcement).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Enforces approved authorizations for logical access to files and directories, directly preventing remote unauthenticated attackers from reading or writing arbitrary files via File Station.
Validates inputs to File Station to block path traversal or directory manipulation attempts that enable external parties to access unauthorized files.
Controls access to publicly accessible content in File Station, ensuring only authorized external parties can read or write files and directories.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability in the public-facing File Station application enables remote unauthenticated exploitation (T1190). It directly permits reading arbitrary files (T1005: Data from Local System) and writing files (T1105: Ingress Tool Transfer).
NVD Description
A files or directories accessible to external parties vulnerability has been reported to affect File Station 5. If exploited, the vulnerability could allow remote attackers to read/write files or directories. We have already fixed the vulnerability in the following versions:…
more
File Station 5 5.5.6.4741 and later
Deeper analysisAI
CVE-2024-48864 is a files or directories accessible to external parties vulnerability (CWE-552) affecting QNAP's File Station 5. Published on 2025-03-07, it carries a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), indicating critical severity due to its potential for high confidentiality and integrity impacts without availability disruption.
Remote, unauthenticated attackers can exploit this vulnerability over the network with low attack complexity and no user interaction required. Exploitation enables them to read and write arbitrary files or directories accessible through File Station 5, potentially leading to unauthorized data access, modification, or persistence on the targeted system.
QNAP has mitigated the issue in File Station 5 version 5.5.6.4741 and later releases. Administrators should update to these patched versions promptly. Additional details are available in the vendor's security advisory at https://www.qnap.com/en/security-advisory/qsa-24-55.
Details
- CWE(s)