Video Station
CVE-2021-33181
CRITICAL
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionNVD
Server-Side Request Forgery (SSRF) vulnerability in webapi component in Synology Video Station before 2.4.10-1632 allows remote authenticated users to send arbitrary request to intranet resources via unspecified vectors.
AnalysisAI
Server-Side Request Forgery (SSRF) vulnerability in webapi component in Synology Video Station before 2.4.10-1632 allows remote authenticated users to send arbitrary request to intranet resources via. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified as Server-Side Request Forgery (SSRF) (CWE-918), which allows attackers to make the server perform requests to unintended internal or external resources. Server-Side Request Forgery (SSRF) vulnerability in webapi component in Synology Video Station before 2.4.10-1632 allows remote authenticated users to send arbitrary request to intranet resources via unspecified vectors. Affected products include: Synology Video Station. Version information: before 2.4.10.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Validate and allowlist destination URLs, block requests to internal networks, use network segmentation.
More in Video Station
View allSynology Video Station before 1.5-0763 allows remote attackers to execute arbitrary shell commands via shell metacharact
SQL injection vulnerability in Synology Video Station before 1.5-0763 allows remote attackers to execute arbitrary SQL c
SQL injection vulnerability in Synology Video Station before 1.5-0757 allows remote attackers to execute arbitrary SQL c
QNAP has already patched this vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploita
An OS command injection vulnerability has been reported to affect Video Station. Rated high severity (CVSS 8.8), this vu
An SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, the
A SQL injection vulnerability has been reported to affect Video Station. Rated high severity (CVSS 8.8), this vulnerabil
An OS command injection vulnerability has been reported to affect several QNAP operating system versions. Rated high sev
A command injection vulnerability has been reported to affect certain versions of Video Station. Rated high severity (CV
An SQL injection vulnerability has been reported to affect Video Station. If an attacker gains local network access who
An improper certificate validation vulnerability has been reported to affect Video Station. If an attacker gains local n
Multiple cross-site scripting (XSS) vulnerabilities in Synology Video Station 1.2 before 1.2-0455, 1.5 before 1.5-0772,
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today