CVE-2017-9554

MEDIUM EXPLOITED IN THE WILD

Synology DSM <6.1.3-15152 - Info Disclosure

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2017-9554 has been observed exploited in the wild (reported by VulnCheck KEV, InTheWild.io). EIP tracks 4 public exploits from researchers including Steve Kaun, rfcl, Ez0-yf, including a Metasploit module auxiliary/scanner/http/synology_forget_passwd_user_enum.

AI-analyzed exploit summary This writeup describes a username enumeration vulnerability in Synology DiskStation Manager (DSM) via the 'forget_passwd.cgi' endpoint. The attack vector involves sending a GET request with a username parameter to check for valid usernames.

Description

An information exposure vulnerability in forget_passwd.cgi in Synology DiskStation Manager (DSM) before 6.1.3-15152 allows remote attackers to enumerate valid usernames via unspecified vectors.

Exploits (4)

exploitdb WRITEUP
by Steve Kaun · textwebappscgi
https://www.exploit-db.com/exploits/43455

This writeup describes a username enumeration vulnerability in Synology DiskStation Manager (DSM) via the 'forget_passwd.cgi' endpoint. The attack vector involves sending a GET request with a username parameter to check for valid usernames.

Classification
Writeup 90%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: Synology DiskStation Manager (DSM) before 6.1.3-15152
No auth needed
Prerequisites: Network access to the target DSM instance
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 2 stars
by rfcl · remote
https://github.com/rfcl/Synology-DiskStation-User-Enumeration-CVE-2017-9554-

This Python script exploits CVE-2017-9554 to enumerate valid users on Synology DiskStation by sending HTTP requests to the forget_passwd.cgi endpoint and analyzing the response. It checks for the 'no mail or no priviege' message to confirm valid usernames.

Classification
Working Poc 95%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: Synology DiskStation < v6.1.3-15152
No auth needed
Prerequisites: Network access to the target Synology DiskStation · Port 5001 (or custom port) accessible
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC
by Ez0-yf · remote
https://github.com/Ez0-yf/CVE-2017-9554-Exploit-Tool

This exploit tool targets CVE-2017-9554, a user enumeration vulnerability in Synology DiskStation Manager (DSM) versions before 6.1.3-15152. It leverages the 'forget_passwd.cgi' endpoint to enumerate valid usernames by comparing response patterns.

Classification
Working Poc 90%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: Synology DiskStation Manager (DSM) < 6.1.3-15152
No auth needed
Prerequisites: Network access to the target DSM instance · A wordlist or username list for enumeration
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit SCANNER
by h00die, Steve Kaun · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/synology_forget_passwd_user_enum.rb

This Metasploit module enumerates users on Synology NAS devices by exploiting a user enumeration vulnerability in the forgot password functionality. It sends GET requests to the target and analyzes the response to determine if a user exists.

Classification
Scanner 100%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: Synology DiskStation Manager (DSM) versions: DSM 6.1 < 6.1.3-15152, DSM 6.0 < 6.0.3-8754-4, DSM 5.2 < 5.2-5967-04
No auth needed
Prerequisites: Network access to the target Synology NAS device · A list of usernames to test (optional)
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (2)

Core 2
Core References
Mitigation, Vendor Advisory x_refsource_confirm
https://www.synology.com/en-global/support/security/Synology_SA_17_29_DSM
Exploit, Third Party Advisory exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/43455/

Scores

CVSS v3 5.3
EPSS 0.7502
EPSS Percentile 99.4%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Details

VulnCheck KEV 2021-12-23
InTheWild.io 2021-12-23
CWE
CWE-200
Status published
Products (1)
synology/diskstation_manager < 6.1.1-15101-4
Published Jul 24, 2017
Tracked Since Feb 18, 2026