CVE-2017-9552

First published: Tue Jun 13 2017(Updated: )

A design flaw in authentication in Synology Photo Station 6.0-2528 through 6.7.1-3419 allows local users to obtain credentials via cmdline. Synology Photo Station employs the synophoto_dsm_user program to authenticate username and password by "synophoto_dsm_user --auth USERNAME PASSWORD", and local users are able to obtain credentials by sniffing "/proc/*/cmdline".

Credit: security@synology.com

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• collector/nvd-index
• agent/type
• agent/weakness
• agent/references
• agent/severity
• agent/author
• agent/tags
• agent/event
• agent/description
• agent/first-publish-date
• agent/last-modified-date
• agent/softwarecombine
• vendor/synology
• canonical/synology photo station
• version/synology photo station/6.0-2528
• version/synology photo station/6.0-2636
• version/synology photo station/6.0-2638
• version/synology photo station/6.0-2639
• version/synology photo station/6.0-2640
• version/synology photo station/6.3-2944
• version/synology photo station/6.3-2958
• version/synology photo station/6.3-2960
• version/synology photo station/6.3-2962
• version/synology photo station/6.3-2963
• version/synology photo station/6.3-2964
• version/synology photo station/6.3-2965
• version/synology photo station/6.4-3166
• version/synology photo station/6.5.0-3218
• version/synology photo station/6.5.1-3223
• version/synology photo station/6.5.2-3225
• version/synology photo station/6.5.3-3226
• version/synology photo station/6.6.0-3339
• version/synology photo station/6.6.1-3345
• version/synology photo station/6.6.1-3346
• version/synology photo station/6.6.2-3346
• version/synology photo station/6.6.3-3347
• version/synology photo station/6.7.0-3414
• version/synology photo station/6.7.1-3419