Synology Media Server vulnerabilities

6 CVEs affecting Synology Media Server, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-4464, published 2024-12-18.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-22683, published 2022-07-28. Critical severity, CVSS 9.8. EPSS: 1.6% chance of exploitation in the next 30 days. Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in cgi component in Synology Media Server before 1.8.1-2876 allows remote attackers to execute arbitrary code via…
CVE-2018-8914, published 2018-05-10. Critical severity, CVSS 9.8. EPSS: 1.3% chance of exploitation in the next 30 days. SQL injection vulnerability in UPnP DMA in Synology Media Server before 1.7.6-2842 and before 1.4-2654 allows remote attackers to execute arbitrary SQL commands via the ObjectID parameter.
CVE-2021-34808, published 2021-06-18. Medium severity, CVSS 5.3. EPSS: 1% chance of exploitation in the next 30 days. Server-Side Request Forgery (SSRF) vulnerability in cgi component in Synology Media Server before 1.8.3-2881 allows remote attackers to access intranet resources via unspecified vectors.
CVE-2021-33180, published 2021-06-01. Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days. Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in cgi component in Synology Media Server before 1.8.1-2876 allows remote attackers to execute…
CVE-2022-27614, published 2022-07-28. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. Exposure of sensitive information to an unauthorized actor vulnerability in web server in Synology Media Server before 1.8.1-2876 allows remote attackers to obtain sensitive information via…
CVE-2024-4464, published 2024-12-18. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. Authorization bypass through user-controlled key vulnerability in streaming service in Synology Media Server before 1.4-2680, 2.0.5-3152 and 2.2.0-3325 allows remote attackers to read specific files…