CVE-2017-9552

2017-06-1313:00:00

CWE-522

synology

www.cve.org

7.7 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

A design flaw in authentication in Synology Photo Station 6.0-2528 through 6.7.1-3419 allows local users to obtain credentials via cmdline. Synology Photo Station employs the synophoto_dsm_user program to authenticate username and password by “synophoto_dsm_user --auth USERNAME PASSWORD”, and local users are able to obtain credentials by sniffing “/proc/*/cmdline”.

CNA Affected

[
  {
    "product": "Synology Photo Station",
    "vendor": "Synology",
    "versions": [
      {
        "status": "affected",
        "version": "6.0-2528 through 6.7.1-3419"
      }
    ]
  }
]