CVE-2017-11156CWE-276

CVE-2017-11156: vulnerability in Synology Download Station

Published · Updated

Follow this CVE+ Monitor Synology Download Station

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 2.3%
Synology Download Station 3.8.x before 3.8.5-3475 and 3.x before 3.5-2984 uses weak permissions (0777) for ui/dlm/btsearch directory, which allows remote authenticated users to execute arbitrary code by uploading an executable via unspecified vectors.
Affected products
Synology · Synology Download Station
Related CVEs — Synology Download Station

In the same product, most dangerous first.

CVE-2017-11149—CVE-2017-11149EPSS 1.6%CVE-2021-33184HIGHCVE-2021-33184EPSS 1.0%