CVE-2015-6912 Synology Video Station before 1.5-0763 allows remote attackers to execute arbitrary shell commands via shell metacharacters in the subtitle_codepage parameter to subtitle.cgi.

HighCVSS 10.0 EPSS 11.8% Public exploit

Published: 2015-09-11 19:00
Updated: 2026-06-17 03:31
Exploit status: Public exploit available

Description

Synology Video Station before 1.5-0763 allows remote attackers to execute arbitrary shell commands via shell metacharacters in the subtitle_codepage parameter to subtitle.cgi.

Affected products

Product	Affected versions	Fixed in
Synology video station	<= 1.5-0757	No fix listed

References

packetstormsecurity.com exploit
20150909 Synology Video Station command injection and multiple SQL injection vulnerabilities mailing-list
20150909 Synology Video Station command injection and multiple SQL injection vulnerabilities mailing-list
www.securify.nl exploit
www.synology.com

CVSS v2.0

10.0 High

AV:N/AC:L/Au:N/C:C/I:C/A:C

Access Vector: Network
Access Complexity: Low
Authentication: None
Confidentiality: Complete
Integrity: Complete
Availability: Complete

Weakness & likelihood

EPSS (exploitation probability, 30 days): 11.79% (percentile 96.1)
CWE: CWE-77

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

Synology Video Station 1.5-0757 - Multiple Vulnerabilities Exploit · Exploit Database (OffSec) · 2015-09-10