CVE-2017-9554

This Python script exploits CVE-2017-9554 to enumerate valid users on Synology DiskStation by sending HTTP requests to the forget_passwd.cgi endpoint and analyzing the response. It checks for the 'no mail or no priviege' message to confirm valid usernames.

This exploit tool targets CVE-2017-9554, a user enumeration vulnerability in Synology DiskStation Manager (DSM) versions before 6.1.3-15152. It leverages the 'forget_passwd.cgi' endpoint to enumerate valid usernames by comparing response patterns.

This Metasploit module enumerates users on Synology NAS devices by exploiting a user enumeration vulnerability in the forgot password functionality. It sends GET requests to the target and analyzes the response to determine if a user exists.

This writeup describes a username enumeration vulnerability in Synology DiskStation Manager (DSM) via the 'forget_passwd.cgi' endpoint. The attack vector involves sending a GET request with a username parameter to check for valid usernames.