Untrusted Search Path Vulnerabilities in Synology Photo Station Uploader for Windows

CVE-2017-11159

What is CVE-2017-11159?

The Synology Photo Station Uploader for Windows is susceptible to multiple untrusted search path vulnerabilities that allow local attackers to inject malicious dynamic-link libraries (DLLs). An attacker can exploit this flaw to execute arbitrary code by placing a Trojan horse DLL, such as shfolder.dll, ntmarta.dll, secur32.dll, or dwmapi.dll, in the current working directory. This exposes users to various security risks, including unauthorized control over their systems.

References