CVE-2022-27626: synology diskstation_manager Race Condition

Vulnerability summary

CVE-2022-27626 is a critical (CVSS 10.0) Race Condition vulnerability in synology diskstation_manager. EPSS estimates a 1.26% chance of exploitation in the next 30 days, higher than 69.2% of scored vulnerabilities.

Timeline

1. 20-10-2022
   PublishedVulnerability first disclosed.
2. 08-05-2025
   Last modifiedVulnerability information updated.

Description

A vulnerability regarding concurrent execution using shared resource with improper synchronization ('Race Condition') is found in the session processing functionality of Out-of-Band (OOB) Management. This allows remote attackers to execute arbitrary commands via unspecified vectors. The following models with Synology DiskStation Manager (DSM) versions before 7.1.1-42962-2 may be affected: DS3622xs+, FS3410, and HD6500.

• CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.