CVE-2017-9554

EPSS 75.0%◆ VulnCheck KEV

Vexday Risk Score

82Fix now

SSVC decision (CISA)

Act

Exploitation + impact → act immediately

Exploit maturity

Functional exploit

Popular PoC on GitHub (2 stars) — exploitation code widely available.

CVSS —EPSS 75.0%KEV nãoPoC públicaNuclei —Metasploit simPatch —

Lifecycle

05 Jan 2011Metasploit module available

24 Jul 2017Published on NVD

08 Jan 2018Public PoC

Weaponization speed

167 daysto first PoC

Recommendation: Patch as soon as possible — active exploitation confirmed.

An information exposure vulnerability in forget_passwd.cgi in Synology DiskStation Manager (DSM) before 6.1.3-15152 allows remote attackers to enumerate valid usernames via unspecified vectors.

Affected products

n/a · n/a

public PoCs found — 6

githubgithub.com/rfcl/Synology-DiskStation-User-Enumeration-CVE-2017-9554-★ 2 githubgithub.com/Ez0-yf/CVE-2017-9554-Exploit-Tool★ 0 cve_referencewww.exploit-db.com/exploits/43455/unverified exploitdbwww.exploit-db.com/exploits/43455unverified vulncheckvulncheck.com/xdb/13f21c95757bunverified vulncheckvulncheck.com/xdb/ca7998802530unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

https://www.exploit-db.com/exploits/43455/https://www.synology.com/en-global/support/security/Synology_SA_17_29_DSM