CVE-2016-10329 Command injection vulnerability in login.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to execute arbitrary code via shell metacharacters in the crafted 'X-Forwarded-For' hea...
CriticalCVSS 9.8
EPSS 40.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Command injection vulnerability in login.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to execute arbitrary code via shell metacharacters in the crafted 'X-Forwarded-For' header.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Synology photo station | <= 6.5.2-3225 | No fix listed |
| synology photo station | = All versions prior to version 6.5.3-3226 | No fix listed |
References
- [oss-security] 20160128 CVE request: Synology Photo Station command injection and privilege escalation exploit mailing-list third-party-advisory vdb-entry
- bamboofox.github.io exploit third-party-advisory
- www.synology.com release-notes