Synology Audio Station vulnerabilities

4 CVEs affecting Synology Audio Station, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-27611, published 2022-07-28.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2017-15888, published 2017-10-30. Medium severity, CVSS 5.4. EPSS: 1.1% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in Custom Internet Radio List in Synology Audio Station before 6.3.0-3260 allows remote authenticated attackers to inject arbitrary web script or HTML via the…
CVE-2022-27611, published 2022-07-28. High severity, CVSS 8.1. EPSS: 1% chance of exploitation in the next 30 days. Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology Audio Station before 6.5.4-3367 allows remote authenticated users to…
CVE-2022-27612, published 2022-07-28. Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days. Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in cgi component in Synology Audio Station before 6.5.4-3367 allows remote attackers to execute arbitrary commands…
CVE-2015-9104, published 2017-06-30. Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerabilities in Synology Audio Station 5.1 before 5.1-2550 and 5.4 before 5.4-2857 allows remote authenticated attackers to inject arbitrary web script or HTML via the…