Synology · Synology Photo Station · CVE-2017-9552
**Name of the Vulnerable Software and Affected Versions**
Synology Photo Station versions 6.0-2528 through 6.7.1-3419
**Description**
A design flaw in the authentication mechanism of Synology Photo Station allows local users to obtain credentials. The `synophoto dsm user` program is used for authentication, and local users can exploit this by sniffing the `/proc/*/cmdline` to obtain the `USERNAME` and `PASSWORD` used in the `synophoto dsm user --auth USERNAME PASSWORD` command.
**Recommendations**
For Synology Photo Station versions 6.0-2528 through 6.7.1-3419, consider restricting access to the `/proc/*/cmdline` to minimize the risk of credential exposure until a patch is available.