PT-2017-14548 · Synology · Synology Diskstation Manager

Published 2017-12-22 · Updated 2025-01-14 · CVE-2017-16766

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Synology DiskStation Manager (DSM) versions prior to 6.1.4-15217 Synology DiskStation Manager (DSM) versions prior to 6.0.3-8754-6

Description An improper access control issue in synodsmnotify allows local users to inject arbitrary web script or HTML via the -fn option. This could potentially lead to unauthorized access or execution of malicious code.

Recommendations For versions prior to 6.1.4-15217, update to version 6.1.4-15217 or later. For versions prior to 6.0.3-8754-6, update to version 6.0.3-8754-6 or later. As a temporary workaround, consider restricting access to the synodsmnotify utility until a patch is applied.

Fix

Special Elements Injection

Improper Access Control

Weakness Enumeration

CWE-74

CWE-284

Related Identifiers

CVE-2017-16766

Affected Products

Synology Diskstation Manager

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-16766 · Security Note
• https://synology.com/en-global/support/security/Synology_SA_17_74 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-16766 · Vendor Advisory
• https://t.me/cvenotify/107341 · Telegram Post