Out-of-bounds Read Vulnerability in Synology DiskStation Manager
CVE-2021-27647

9.8CRITICAL

Key Information:

Vendor
Synology
Status
Synology Diskstation Manager (dsm)
Vendor
CVE Published:
12 March 2021

Summary

An Out-of-bounds Read vulnerability in the iscsi_snapshot_comm_core component of Synology DiskStation Manager versions prior to 6.2.3-25426-3 can enable remote attackers to perform unauthorized actions. By sending specially crafted web requests, attackers can gain the ability to execute arbitrary code, potentially compromising the integrity and availability of the affected system. Users are strongly advised to upgrade to the latest version of DSM to mitigate the risk associated with this vulnerability.

Affected Version(s)

Synology DiskStation Manager (DSM) < 6.2.3-25426-3

References

https://www.synology.com/security/advisory/Synology_SA_20_26
x_refsource_CONFIRM
https://www.zerodayinitiative.com/advisories/ZDI-21-339/
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.