CVE-2021-27646: (Pwn2Own) Synology DiskStation Manager iscsi_snapshot_comm_core Use-After-Free Remote Code Execution Vulnerability
First published: Fri Mar 12 2021(Updated: )
Use After Free vulnerability in iscsi_snapshot_comm_core in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via crafted web requests.
Credit: security@synology.com security@synology.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Synology DiskStation Manager | <6.2.3-25426-3 | |
| Synology DiskStation Manager | <6.2.3-25426-3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2021-27646.
What is the severity of CVE-2021-27646?
The severity of CVE-2021-27646 is critical with a CVSS score of 9.8.
How can local attackers exploit CVE-2021-27646?
Local attackers can exploit CVE-2021-27646 to execute arbitrary code on affected installations of Synology DS418play.
Is authentication required to exploit CVE-2021-27646?
No, authentication is not required to exploit CVE-2021-27646.
What is the affected software for CVE-2021-27646?
The affected software for CVE-2021-27646 is Synology DiskStation Manager version up to 6.2.3-25426-3.
- collector/nvd-index
- agent/references
- agent/type
- agent/softwarecombine
- agent/title
- agent/weakness
- agent/author
- agent/description
- agent/severity
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/first-publish-date
- agent/trending
- agent/tags
- collector/zdi-advisory
- source/ZDI
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- vendor/synology
- canonical/synology diskstation manager