CVE-2017-9554

moderate-risk

Published 2017-07-24

An information exposure vulnerability in forget_passwd.cgi in Synology DiskStation Manager (DSM) before 6.1.3-15152 allows remote attackers to enumerate valid usernames via unspecified vectors.

Do I need to act?

57.9% chance of exploitation in next 30 days

EPSS score — higher than 42% of all CVEs

Not on CISA KEV list

No confirmed active exploitation reported to CISA

1 public exploit available

43455

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 5.3/10 Medium

NETWORK / LOW complexity

Affected Products (1)

Diskstation Manager

Affected Vendors

Synology

References (4)

https://www.exploit-db.com/exploits/43455/

Mitigation https://www.synology.com/en-global/support/security/Synology_SA_17_29_DSM

https://www.exploit-db.com/exploits/43455/

Mitigation https://www.synology.com/en-global/support/security/Synology_SA_17_29_DSM

/ 100

moderate-risk

Severity 21/34 · High

Exploitability 18/34 · Moderate

Exposure 5/34 · Minimal