PT-2017-14267 · Synology · Synology Diskstation Manager
CVE-2017-15889
·
Publicado
2017-12-04
·
Atualizado
2025-01-14
CVSS v3.1
8.8
Alta
| Vetor | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Synology DiskStation Manager (DSM) versions prior to 5.2-5967-5
Description
The issue allows remote authenticated users to execute arbitrary commands via the
disk field in the smart.cgi script. This can be exploited by sending a malicious request to the vulnerable API endpoint.Recommendations
For versions prior to 5.2-5967-5, update to version 5.2-5967-5 or later to resolve the issue. As a temporary workaround, consider restricting access to the
smart.cgi script to minimize the risk of exploitation.Exploit
Correção
Command Injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Synology Diskstation Manager