CVE-2017-11156: synology download_station Incorrect Default Permissions
CVSS: 7.8v3.0HighModified
Published 14-08-2017Last modified 16-09-2024
Vulnerability summary
CVE-2017-11156 is a high (CVSS 7.8) Incorrect Default Permissions vulnerability in synology download_station. EPSS estimates a 2.30% chance of exploitation in the next 30 days, higher than 83% of scored vulnerabilities.
CVSS score
7.8/10
010
High · v3.0 (NVD)EPSS score
2.30%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 14-08-2017PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
Synology Download Station 3.8.x before 3.8.5-3475 and 3.x before 3.5-2984 uses weak permissions (0777) for ui/dlm/btsearch directory, which allows remote authenticated users to execute arbitrary code by uploading an executable via unspecified vectors.
CVSS metrics
2 scores · 1 source · 2 versionsHigh 7.8Preferred score · NVD (NIST)
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSourcesSingle source
Medium 6.5Preferred score · NVD (NIST)
AV:N/AC:L/Au:S/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
2.30%
Chance of exploitation in the next 30 days
Percentile
83%
Versus all other CVEs
30-day change
0.00 pp
From 2.30% on 19-09-2026
19-09-202619-10-2026
EPSS score2.30%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-276Incorrect Default PermissionsDuring installation, installed file permissions are set to allow anyone to modify those files.
- CWE-732Incorrect Permission Assignment for Critical ResourceThe product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
Affected systems
Synology2 products
- download_station3.2-2295 | 3.3-2382 | 3.3-2383 | 3.3-2386 | 3.4-2477 | 3.4-2478 | 3.4-2480 | 3.4-2485 | 3.4-2486 | 3.4-2489 | 3.4-2490 | 3.4-2514 | 3.4-2555 | 3.4-2557 | 3.4-2558 | 3.5-2638 | 3.5-2705 | 3.5-2706 | 3.5-2955 | 3.5-2956 | 3.5-2962 | 3.5-2963 | 3.5-2967 | 3.5-2968 | 3.5-2970 | 3.5-2973 | 3.5-2980 | 3.5-2982 | 3.8.0-3416 | 3.8.1-3420 | 3.8.2-3455 | 3.8.3-3458 | 3.8.4-3468
- synology download station3.8.x before 3.8.5-3475 and 3.x before 3.5-2984
1 vendor · 2 products
References
1 links- www.synology.com/en-global/support/security/Synology_SA_17_28_Download_StationX Refsource CONFIRMVendor Advisory