Synology Vulnerabilities and Affected Products
Vulnerabilities associated with Media Server.
Products
Clear product- DiskStation Manager (DSM)53 vulnerabilities
- Synology Router Manager (SRM)43 vulnerabilities
- Surveillance Station25 vulnerabilities
- Synology Photo Station18 vulnerabilities
- Synology DiskStation Manager (DSM)13 vulnerabilities
- Photo Station12 vulnerabilities
- Camera Firmware9 vulnerabilities
- Drive7 vulnerabilities
- BeeDrive for desktop6 vulnerabilities
- Calendar6 vulnerabilities
- camera_firmware6 vulnerabilities
- router_manager6 vulnerabilities
- Synology Drive Client6 vulnerabilities
- Unified Controller (DSMUC)6 vulnerabilities
- Media Server5 vulnerabilities
- Synology Active Backup for Business Agent5 vulnerabilities
- Synology Calendar5 vulnerabilities
- Active Backup for Business4 vulnerabilities
- Note Station4 vulnerabilities
- active_backup_for_business_agent3 vulnerabilities
- Audio Station3 vulnerabilities
- BeeStation OS (BSM)3 vulnerabilities
- Download Station3 vulnerabilities
- Safe Access3 vulnerabilities
- Synology Download Station3 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2024-4464HIGH | Authorization bypass through user-controlled key vulnerability in streaming service in Synology Media Server before 1.4-2680, 2.0.5-3152 and 2.2.0-3325 allows remote attackers to read specific files via unspecified vectors. CWE-639Dec 18, 2024 | CVSS7.5v3.1 | EPSS0.548% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2022-22683CRITICAL | Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in cgi component in Synology Media Server before 1.8.1-2876 allows remote attackers to execute arbitrary code via unspecified vectors. CWE-120Jul 28, 2022 | CVSS10.0v3.1 | EPSS1.53% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2022-27614MEDIUM | Exposure of sensitive information to an unauthorized actor vulnerability in web server in Synology Media Server before 1.8.1-2876 allows remote attackers to obtain sensitive information via unspecified vectors. CWE-200Jul 28, 2022 | CVSS5.3v3.1 | EPSS0.872% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2021-34808MEDIUM | Server-Side Request Forgery (SSRF) vulnerability in cgi component in Synology Media Server before 1.8.3-2881 allows remote attackers to access intranet resources via unspecified vectors. CWE-918Jun 18, 2021 | CVSS5.8v3.1 | EPSS1.02% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2018-8914HIGH | SQL injection vulnerability in UPnP DMA in Synology Media Server before 1.7.6-2842 and before 1.4-2654 allows remote attackers to execute arbitrary SQL commands via the ObjectID parameter. CWE-89May 10, 2018 | CVSS7.3v3.0 | EPSS1.31% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |