ZDI-CAN-19609: ZDI-23-658: (Pwn2Own) Synology DiskStation Manager api.php Authentication Bypass Vulnerability
Published May 17, 2023
·Updated
This vulnerability allows remote attackers to bypass authentication on affected installations of Synology DiskStation Manager. Authentication is not required to exploit this vulnerability.
Affected Software
1 affected component
Synology Diskstation Manager
Event History
May 17, 2023
Advisory Published
05:00 AM
Data Sourced
05:00 AM
Description
Frequently Asked Questions
1
What is the severity of ZDI-CAN-19609?
The severity of ZDI-CAN-19609 is critical due to the ability for remote attackers to bypass authentication.
2
How do I fix ZDI-CAN-19609?
To fix ZDI-CAN-19609, update your Synology DiskStation Manager to the latest version provided by Synology.
3
What systems are affected by ZDI-CAN-19609?
ZDI-CAN-19609 affects installations of Synology DiskStation Manager.
4
Can attackers exploit ZDI-CAN-19609 without authentication?
Yes, attackers can exploit ZDI-CAN-19609 without needing authentication.
5
What are the potential impacts of ZDI-CAN-19609?
The potential impacts of ZDI-CAN-19609 include unauthorized access and control over the affected Synology devices.