CVE-2010-3684: Low severity Synology DSM vulnerability
The FTP authentication module in Synology Disk Station 2.x logs passwords to the web application interface in cases of incorrect login attempts, which allows local users to obtain sensitive information by reading a log, a different vulnerability than CVE-2010-2453.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2010-3684?
CVE-2010-3684 has a medium severity rating due to its potential to expose sensitive information.
How do I fix CVE-2010-3684?
To fix CVE-2010-3684, you should update the Synology Disk Station firmware to the latest version that addresses this vulnerability.
What versions of Synology Disk Station are affected by CVE-2010-3684?
CVE-2010-3684 affects Synology Disk Station DSM 2.x versions, specifically 2.2-0942, 2.2-1041, 2.2-1042, 2.2-1045, and 2.3-1139 to 2.3-1161.
How does CVE-2010-3684 operate?
CVE-2010-3684 operates by logging passwords to the web interface on unsuccessful FTP login attempts, which can be accessed by local users.
Who is at risk of CVE-2010-3684?
Local users with access to the Synology Disk Station systems running affected versions are at risk from CVE-2010-3684.