VULNERABILITY INTELLIGENCE

CVE-2017-16766

CVSS score6.5 MEDIUM
EPSS probability0.74%
CISA KEVNot currently listed
Published2017-12-22
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Description

An improper access control vulnerability in synodsmnotify in Synology DiskStation Manager (DSM) before 6.1.4-15217 and before 6.0.3-8754-6 allows local users to inject arbitrary web script or HTML via the -fn option.

Weakness classification

  • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
  • CWE-284: Improper Access Control

Primary references