Synology Drive Client vulnerabilities

6 CVEs affecting Synology Drive Client, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-52946, published 2024-09-26.

More from Synology.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2022-49037, published 2024-09-26. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. Insertion of sensitive information into log file vulnerability in proxy settings component in Synology Drive Client before 3.3.0-15082 allows remote authenticated users to obtain sensitive…
• CVE-2023-52946, published 2024-09-26. High severity, CVSS 8.2. EPSS: 0.5% chance of exploitation in the next 30 days. Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in vss service component in Synology Drive Client before 3.5.0-16084 allows remote attackers to overwrite trivial…
• CVE-2022-49039, published 2024-09-26. Medium severity, CVSS 6.7. EPSS: 0.2% chance of exploitation in the next 30 days. Out-of-bounds write vulnerability in backup task management functionality in Synology Drive Client before 3.4.0-15721 allows local users with administrator privileges to execute arbitrary commands…
• CVE-2022-49038, published 2024-09-26. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. Inclusion of functionality from untrusted control sphere vulnerability in OpenSSL DLL component in Synology Drive Client before 3.3.0-15082 allows local users to execute arbitrary code via…
• CVE-2022-49041, published 2024-09-26. Medium severity, CVSS 4.4. EPSS: 0.2% chance of exploitation in the next 30 days. Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in backup task management functionality in Synology Drive Client before 3.4.0-15721 allows local users with…
• CVE-2022-49040, published 2024-09-26. Medium severity, CVSS 4.4. EPSS: 0.2% chance of exploitation in the next 30 days. Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in connection management functionality in Synology Drive Client before 3.4.0-15721 allows local users with…