cve.bz

CVE-2017-9552

7.8 highEPSS 0.3%

High (7.8) in synology photo station. EPSS 0.3% chance of exploitation in the next 30 days.

A design flaw in authentication in Synology Photo Station 6.0-2528 through 6.7.1-3419 allows local users to obtain credentials via cmdline. Synology Photo Station employs the synophoto_dsm_user program to authenticate username and password by "synophoto_dsm_user --auth USERNAME PASSWORD", and local users are able to obtain credentials by sniffing "/proc/*/cmdline".

Severity

CVSS 3.0

7.8 high
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS
0.3% chance of exploitation in the next 30 days; higher than 24% of CVEs (scores of 2026-10-31)
CWEs
CWE-287, CWE-522
Published
Modified
Record from
the NVD, synced

Affected

References

Check your stackJSON