Skip to main content

Diskstation Manager CVE-2022-22687

CRITICAL
Classic Buffer Overflow (CWE-120)
2022-03-25 security@synology.com
Synology RCE Buffer Overflow Diskstation Manager Diskstation Manager Unified Controller
9.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Mar 25, 2022 - 07:15 nvd
CRITICAL 9.8

DescriptionNVD

Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in Authentication functionality in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via unspecified vectors.

AnalysisAI

Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in Authentication functionality in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Buffer Copy without Size Check (CWE-120), which allows attackers to overflow a buffer to corrupt adjacent memory. Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in Authentication functionality in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via unspecified vectors. Affected products include: Synology Diskstation Manager, Synology Diskstation Manager Unified Controller. Version information: before 6.2.3.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Always validate buffer sizes before copy operations. Use bounded functions (strncpy, snprintf). Enable compiler protections.

More in Diskstation Manager

View all
CVE-2013-6955 CRITICAL POC
10.0 Jan 09

webman/imageSelector.cgi in Synology DiskStation Manager (DSM) 4.0 before 4.0-2259, 4.2 before 4.2-3243, and 4.3 before

CVE-2017-5753 MEDIUM POC
5.6 Jan 04

Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of

CVE-2017-15889 HIGH POC
8.8 Dec 04

Command injection vulnerability in smart.cgi in Synology DiskStation Manager (DSM) before 5.2-5967-5 allows remote authe
CVE-2017-14491 CRITICAL POC
9.8 Oct 04

Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execut
CVE-2017-9554 MEDIUM POC
5.3 Jul 24

An information exposure vulnerability in forget_passwd.cgi in Synology DiskStation Manager (DSM) before 6.1.3-15152 allo
CVE-2013-6987 HIGH POC
7.5 Dec 31

Multiple directory traversal vulnerabilities in the FileBrowser components in Synology DiskStation Manager (DSM) before

CVE-2021-3156 HIGH POC
7.8 Jan 26

Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege
CVE-2018-8897 HIGH POC
7.8 May 08

A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) wa
CVE-2018-1160 CRITICAL POC
9.8 Dec 20

Netatalk before 3.1.12 is vulnerable to an out of bounds write in dsi_opensess.c. Rated critical severity (CVSS 9.8), th
CVE-2021-26566 CRITICAL POC
9.0 Feb 26

Insertion of sensitive information into sent data vulnerability in synorelayd in Synology DiskStation Manager (DSM) befo
CVE-2020-27648 CRITICAL POC
9.0 Oct 29

Improper certificate validation vulnerability in OpenVPN client in Synology DiskStation Manager (DSM) before 6.2.3-25426
CVE-2021-26564 HIGH POC
8.7 Feb 26

Cleartext transmission of sensitive information vulnerability in synorelayd in Synology DiskStation Manager (DSM) before

Same weakness CWE-120 – Classic Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2016-10174 CRITICAL POC
9.8
CVE-2016-0099 HIGH POC
7.8
CVE-2016-6366 HIGH POC
8.8
CVE-2013-1331 HIGH
7.8
CVE-2013-0641 HIGH
7.8
CVE-2017-15222 CRITICAL POC
9.8
CVE-2012-2763 HIGH POC
7.5

Same technique RCE

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2025-53770 CRITICAL POC
9.8
CVE-2020-7961 CRITICAL POC
9.8

Share

CVE-2022-22687 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy