← back
CVE-2015-6912

CVE-2015-6912

EPSS 11.8%
Synology Video Station before 1.5-0763 allows remote attackers to execute arbitrary shell commands via shell metacharacters in the subtitle_codepage parameter to subtitle.cgi.
Affected products
n/a · n/a
public PoCs found — 2
cve_referencepacketstormsecurity.com/files/133519/Synology-Video-Station-1.5-0757-Command-Injection-SQL-Injection.htmlunverifiedexploitdbwww.exploit-db.com/exploits/38128unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
http://packetstormsecurity.com/files/133519/Synology-Video-Station-1.5-0757-Command-Injection-SQL-Injection.htmlhttp://seclists.org/fulldisclosure/2015/Sep/31https://www.securify.nl/advisory/SFY20150810/synology_video_station_command_injection_and_multiple_sql_injection_vulnerabilities.htmlhttps://www.synology.com/en-global/releaseNote/VideoStation?model=DS715http://www.securityfocus.com/archive/1/536427/100/0/threaded