CVE-2021-26561: Buffer Overflow
Published Feb 26, 2021
·Updated
Stack-based buffer overflow vulnerability in synoagentregisterd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-the-middle attackers to execute arbitrary code via synofindersite HTTP header.
Affected Software
14 affected components
Synology Diskstation Manager<6.2.3-25426-3
Synology Vs960hd Firmware
Synology Vs960hd
Synology Skynas Firmware
Synology Skynas
Synology Diskstation Manager Unified Controller=3.0
Synology Uc3200
Synology Diskstation Manager<6.2.3-25426-3
All of the following
Synology Vs960hd Firmware
Synology Vs960hd
All of the following
Synology Skynas Firmware
Synology Skynas
All of the following
Synology Diskstation Manager Unified Controller=3.0
Synology Uc3200
Event History
Feb 26, 2021
CVE Published
via MITRE·09:45 PM
Data Sourced
via MITRE·09:45 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2021-26561?
The severity of CVE-2021-26561 is critical with a CVSS score of 8.1.
2
How does CVE-2021-26561 affect Synology DiskStation Manager (DSM)?
CVE-2021-26561 affects Synology DiskStation Manager (DSM) versions up to and including 6.2.3-25426-3.
3
How can man-in-the-middle attackers exploit CVE-2021-26561?
Man-in-the-middle attackers can exploit CVE-2021-26561 by sending a specially crafted syno_finder_site HTTP header.
4
Are Synology Vs960hd and Synology Skynas affected by CVE-2021-26561?
No, Synology Vs960hd and Synology Skynas are not affected by CVE-2021-26561.
5
Is there a fix for CVE-2021-26561?
Yes, Synology has released a patch for CVE-2021-26561. Please refer to the official advisory for more details.