ZDI-23-659: (Pwn2Own) Synology DiskStation Manager dnsauth.php Missing Authentication Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Synology DiskStation Manager. This vulnerability does not require authentication, but does require some user interaction.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-23-659?
The severity of ZDI-23-659 is considered high due to its potential for sensitive information disclosure.
How do I fix ZDI-23-659?
To fix ZDI-23-659, ensure that you are using the latest version of Synology DiskStation Manager and apply all available security updates.
What are the risks associated with ZDI-23-659?
The risks associated with ZDI-23-659 include potential exposure of sensitive information to remote attackers without requiring authentication.
Do I need to be an authenticated user to exploit ZDI-23-659?
No, ZDI-23-659 does not require authentication, but it does require some form of user interaction.
What versions of Synology DiskStation Manager are affected by ZDI-23-659?
All installations of Synology DiskStation Manager that have not been updated to the patched version are potentially affected by ZDI-23-659.