Authentication Vulnerability in Synology Photo Station Affects User Credentials

CVE-2017-9552

Summary

A design flaw in the authentication mechanism of Synology Photo Station versions 6.0-2528 through 6.7.1-3419 allows local users to access and retrieve user credentials. The flaw arises from the usage of the synophoto_dsm_user program, which authenticates usernames and passwords through the command line. By sniffing the '/proc/*/cmdline' directory, unauthorized local users can capture sensitive login information, potentially compromising user accounts and sensitive data stored within the application.

References