VULNERABILITY INTELLIGENCE

CVE-2021-31439

CVSS score8.8 HIGH

EPSS probability2.33%

CISA KEVNot currently listed

Published2021-05-21

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Synology DiskStation Manager. Authentication is not required to exploit this vulnerablity. The specific flaw exists within the processing of DSI structures in Netatalk. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-12326.

Weakness classification

zdi-disclosures@trendmicro.com: CWE-122
nvd@nist.gov: CWE-787

Primary references

zdi-disclosures@trendmicro.com — Mailing List, Third Party Advisory
zdi-disclosures@trendmicro.com — Issue Tracking, Third Party Advisory
zdi-disclosures@trendmicro.com — Third Party Advisory
zdi-disclosures@trendmicro.com — Vendor Advisory
zdi-disclosures@trendmicro.com — Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry