CVE-2016-6554 Synology NAS servers DS107, DS116, and DS213, use default credentials
CriticalCVSS 9.8
EPSS 4.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Synology NAS servers DS107, firmware version 3.1-1639 and prior, and DS116, DS213, firmware versions prior to 5.2-5644-1, use non-random default credentials of: guest:(blank) and admin:(blank) . A remote network attacker can gain privileged access to a vulnerable device.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Synology ds107 firmware | <= 3.1-1639 | No fix listed |
| Synology ds213 firmware | <= 5.2-5644-1 | No fix listed |
| Synology ds116 firmware | <= 5.2-5644-1 | No fix listed |
| Synology NAS server DS107 | >= 3.1-1639, <= 3.1-1639 | No fix listed |
| Synology NAS server DS116 | >= 5.2-5644-1, < 5.2-5644-1 | 5.2-5644-1 |
| Synology NAS server DS213 | >= 5.2-5644-1, < 5.2-5644-1 | 5.2-5644-1 |
References
- VU#404187 third-party-advisory us-government-resource
- 93805 third-party-advisory vdb-entry
- www.synology.com release-notes vendor-advisory