CVE-2016-10329: synology photo_station Command Injection
Vulnerability summary
CVE-2016-10329 is a critical (CVSS 9.8) Command Injection vulnerability in synology photo_station. EPSS estimates a 40.81% chance of exploitation in the next 30 days, higher than 98.6% of scored vulnerabilities. 3 public exploits are recorded.
Timeline
- 12-05-2017PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
Command injection vulnerability in login.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to execute arbitrary code via shell metacharacters in the crafted 'X-Forwarded-For' header.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
40.81%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
0.00 pp
From 40.81% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
3 foundExploit Reference (bamboofox.github.io)
Maturity: unknown
Exploit Reference (bamboofox.github.io)
Maturity: unknown
Exploit Reference (seclists.org)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Synology2 products
- photo_station≤ 6.5.2-3225
- synology_photo_stationAll versions prior to version 6.5.3-3226
1 vendor · 2 products
References
4 links- www.synology.com/en-global/support/security/Photo_Station_6_5_3_3226X Refsource CONFIRMRelease Notes