CVE-2017-9552
High
Description
A design flaw in authentication in Synology Photo Station 6.0-2528 through 6.7.1-3419 allows local users to obtain credentials via cmdline. Synology Photo Station employs the synophoto_dsm_user program to authenticate username and password by "synophoto_dsm_user --auth USERNAME PASSWORD", and local users are able to obtain credentials by sniffing "/proc/*/cmdline".
SeverityHigh
CVSS7.8
Exploit probability—
ProductSynology Photo Station
PublishedJun 13, 2017
First seenJun 13, 2017
Weakness typeCWE-522CWE-522
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| synology photo_station | 6.0-2528, 6.0-2636, 6.0-2638, 6.0-2639, 6.0-2640, 6.3-2944, 6.3-2958, 6.3-2960, 6.3-2962, 6.3-2963, 6.3-2964, 6.3-2965, 6.4-3166, 6.5.0-3218, 6.5.1-3223, 6.5.2-3225, 6.5.3-3226, 6.6.0-3339, 6.6.1-3345, 6.6.1-3346, 6.6.2-3346, 6.6.3-3347, 6.7.0-3414, 6.7.1-3419 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.