Synology Photos fixes a critical vulnerability

Do you think this report is well-written? *

Yes

Do you use this technology? *

Yes

Was this report useful to you?

Yes

We would be happy if you would describe:

The security services provided by CESNET are designed to provide significant support in ensuring the cybersecurity of connected organizations. Although we strive to provide quality and reliable services, it is not possible to guarantee absolute coverage of all security vulnerabilities. Our services should be seen as a complement to an organization's own security management, not as a replacement. The client bears ultimate responsibility for securing their environment.

This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] Synology Photos fixes a critical vulnerability

Synology fixes a critical vulnerability in Synology Photos in versions 1.7.0-0795 and 1.6.2-0720 [1]. Synology Photos is an application that can be installed on Synology DiskStation storage systems, and on Synology BeeStation products it is pre-installed and enabled in the default configuration [2]. Synology Photos 1.7.0 requires Synology DiskStation Manager version 7.2.2 or higher to be installed, and 1.6.2 requires version 7.2 or higher [3].

Synology Photos - RCE

CVSS 10.0 (Critical)

An unauthenticated remote attacker can execute code with root privileges, which may lead to complete takeover of the machine [1][2].

The vulnerability is present in product:

Synology Photos; >=1.6, <1.6.2-0720; >=1.7, <1.7.0-0795;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

More information:

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 25. 10. 2024.

Links

By CESNET, z.s.p.o. Martin Krajči on 4. 11. 2024.

Report feedback

[TLP:CLEAR] Synology Photos fixes a critical vulnerability

Synology Photos - RCE

CVSS 10.0 (Critical)

Links