First published: Fri Mar 12 2021(Updated: )
This vulnerability allows local attackers to execute arbitrary code on affected installations of Synology DS418play. Authentication is not required to exploit this vulnerability. The specific flaw exists within the iscsi_snapshot_comm_core service. The issue results from the lack of proper locking when performing operations on an object, which can cause a pointer to be reused after it has been freed. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute code in the context of the current process.
Credit: security@synology.com
Affected Software | Affected Version | How to fix |
---|---|---|
Synology DiskStation Manager | ||
Synology DiskStation Manager | <6.2.3-25426-3 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
The vulnerability ID for this vulnerability is CVE-2021-27646.
The severity of CVE-2021-27646 is critical with a CVSS score of 9.8.
Local attackers can exploit CVE-2021-27646 to execute arbitrary code on affected installations of Synology DS418play.
No, authentication is not required to exploit CVE-2021-27646.
The affected software for CVE-2021-27646 is Synology DiskStation Manager version up to 6.2.3-25426-3.