Untrusted Search Path Vulnerabilities in Synology Cloud Station Drive
CVE-2017-11158

7.8HIGH

Key Information:

Vendor

Synology
Status
Cloud Station Drive
Vendor
CVE Published:
31 August 2017

What is CVE-2017-11158?

The installer for Synology Cloud Station Drive prior to version 4.2.5-4396 on Windows is susceptible to multiple untrusted search path vulnerabilities. These vulnerabilities enable local attackers to execute arbitrary code, potentially leading to DLL hijacking. The exploit can occur via maliciously crafted DLL files such as shfolder.dll, ntmarta.dll, secur32.dll, or dwmapi.dll that are placed in the current working directory, compromising the integrity of the affected system.

Affected Version(s)

Cloud Station Drive before 4.2.5-4396

References

https://www.synology.com/en-global/support/security/Synol...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.