CVE-2013-6955

Synology Diskstation Manager - Access Control

Title source: rule

Description

webman/imageSelector.cgi in Synology DiskStation Manager (DSM) 4.0 before 4.0-2259, 4.2 before 4.2-3243, and 4.3 before 4.3-3810 Update 1 allows remote attackers to append data to arbitrary files, and consequently execute arbitrary code, via a pathname in the SLICEUPLOAD X-TMP-FILE HTTP header.

Exploits (2)

exploitdb WORKING POC VERIFIED
by Metasploit · rubyremoteunix
https://www.exploit-db.com/exploits/30470
metasploit WORKING POC EXCELLENT
by Markus Wulftange · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/synology_dsm_sliceupload_exec_noauth.rb

References (1)

Scores

EPSS 0.8331
EPSS Percentile 99.3%

Details

CWE
CWE-264
Status published
Products (4)
synology/diskstation_manager 4.0
synology/diskstation_manager 4.2
synology/diskstation_manager 4.3
synology/diskstation_manager 4.3-3810
Published Jan 09, 2014
Tracked Since Feb 18, 2026