Synology Download Station vulnerabilities

8 CVEs affecting Synology Download Station, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-34811, published 2021-06-18.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2017-11156, published 2017-08-14. High severity, CVSS 7.8. EPSS: 2.3% chance of exploitation in the next 30 days. Synology Download Station 3.8.x before 3.8.5-3475 and 3.x before 3.5-2984 uses weak permissions (0777) for ui/dlm/btsearch directory, which allows remote authenticated users to execute arbitrary code…
CVE-2015-6909, published 2015-09-11. Medium severity, CVSS 4.3. EPSS: 2.1% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in the "Create download task via file upload" feature in Synology Download Station before 3.5-2962 allows remote attackers to inject arbitrary web script or…
CVE-2021-34809, published 2021-06-18. High severity, CVSS 8.8. EPSS: 1.9% chance of exploitation in the next 30 days. Improper neutralization of special elements used in a command ('Command Injection') vulnerability in task management component in Synology Download Station before 3.8.16-3566 allows remote…
CVE-2015-6913, published 2015-09-11. Medium severity, CVSS 4.3. EPSS: 1.9% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in the "Create download task via URL" feature in Synology Download Station before 3.5-2967 allows remote attackers to inject arbitrary web script or HTML via…
CVE-2017-11149, published 2017-08-14. Medium severity, CVSS 6.5. EPSS: 1.6% chance of exploitation in the next 30 days. Server-side request forgery (SSRF) vulnerability in Downloader in Synology Download Station 3.8.x before 3.8.5-3475 and 3.x before 3.5-2984 allows remote authenticated users to download arbitrary…
CVE-2021-34810, published 2021-06-18. High severity, CVSS 8.8. EPSS: 1.4% chance of exploitation in the next 30 days. Improper privilege management vulnerability in cgi component in Synology Download Station before 3.8.16-3566 allows remote authenticated users to execute arbitrary code via unspecified vectors.
CVE-2021-33184, published 2021-06-01. High severity, CVSS 7.7. EPSS: 1% chance of exploitation in the next 30 days. Server-Side request forgery (SSRF) vulnerability in task management component in Synology Download Station before 3.8.15-3563 allows remote authenticated users to read arbitrary files via unspecified…
CVE-2021-34811, published 2021-06-18. Medium severity, CVSS 4.3. EPSS: 0.8% chance of exploitation in the next 30 days. Server-Side Request Forgery (SSRF) vulnerability in task management component in Synology Download Station before 3.8.16-3566 allows remote authenticated users to access intranet resources via…