CVE-2022-27625

CVSS 10 CRITICALEPSS 1.5%CWE-119

Vexday Risk Score

28Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 10EPSS 1.5%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

20 Oct 2022Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the message processing functionality of Out-of-Band (OOB) Management. This allows remote attackers to execute arbitrary commands via unspecified vectors. The following models with Synology DiskStation Manager (DSM) versions before 7.1.1-42962-2 may be affected: DS3622xs+, FS3410, and HD6500.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected products

Synology · DiskStation Manager (DSM)

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://www.synology.com/security/advisory/Synology_SA_22_17