ZDI-23-660: (Pwn2Own) Synology DiskStation Manager Serv.php Authentication Bypass Vulnerability
This vulnerability allows remote attackers to bypass authentication on affected installations of Synology DiskStation Manager. This vulnerability does not require authentication, but does require some user interaction.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-23-660?
The severity of ZDI-23-660 is considered critical due to its ability to allow remote attackers to bypass authentication.
How do I fix ZDI-23-660?
To fix ZDI-23-660, update your Synology DiskStation Manager to the latest version released by Synology that addresses this vulnerability.
What systems are affected by ZDI-23-660?
ZDI-23-660 affects installations of Synology DiskStation Manager, particularly those that are not updated to the latest security patches.
Can ZDI-23-660 be exploited without authentication?
Yes, ZDI-23-660 can be exploited without authentication, although it requires some form of user interaction.
What type of user interaction is needed to exploit ZDI-23-660?
The specific type of user interaction needed to exploit ZDI-23-660 typically involves the user being tricked into performing an action that enables the bypass of authentication.