Synology DNS Server vulnerabilities

5 CVEs affecting Synology DNS Server, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-27615, published 2022-07-28.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-8623, published 2020-08-21. High severity, CVSS 7.5. EPSS: 6.4% chance of exploitation in the next 30 days. In BIND 9.10.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.10.5-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker that can reach a vulnerable system with a…
CVE-2020-8622, published 2020-08-21. Medium severity, CVSS 6.5. EPSS: 5.6% chance of exploitation in the next 30 days. In BIND 9.0.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker on the network path for a TSIG-signed request,…
CVE-2020-8621, published 2020-08-21. High severity, CVSS 7.5. EPSS: 3% chance of exploitation in the next 30 days. In BIND 9.14.0 -> 9.16.5, 9.17.0 -> 9.17.3, If a server is configured with both QNAME minimization and 'forward first' then an attacker who can send queries to it may be able to trigger the condition…
CVE-2017-12074, published 2017-08-24. Medium severity, CVSS 6.5. EPSS: 2% chance of exploitation in the next 30 days. Directory traversal vulnerability in the SYNO.DNSServer.Zone.MasterZoneConf in Synology DNS Server before 2.2.1-3042 allows remote authenticated attackers to write arbitrary files via the domain_name…
CVE-2022-27615, published 2022-07-28. High severity, CVSS 8.1. EPSS: 1.2% chance of exploitation in the next 30 days. Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in cgi component in Synology DNS Server before 2.2.2-5027 allows remote authenticated users to delete…