Samsung Syncthru Web Service vulnerabilities

8 CVEs affecting Samsung Syncthru Web Service, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-35309, published 2023-08-22.

More from Samsung.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2021-42913, published 2021-12-20. High severity, CVSS 7.5. EPSS: 1.8% chance of exploitation in the next 30 days. The SyncThru Web Service on Samsung SCX-6x55X printers allows an attacker to gain access to a list of SMB users and cleartext passwords by reading the HTML source code. Authentication is not required.
• CVE-2019-7418, published 2019-03-21. Medium severity, CVSS 6.1. EPSS: 1.6% chance of exploitation in the next 30 days. XSS exists in SAMSUNG X7400GX SyncThru Web Service V6.A6.25 V11.01.05.25_08-21-2015 in "/sws/swsAlert.sws" in multiple parameters: flag, frame, func, and Nfunc.
• CVE-2019-7421, published 2019-03-21. Medium severity, CVSS 6.1. EPSS: 1.5% chance of exploitation in the next 30 days. XSS exists in SAMSUNG X7400GX SyncThru Web Service V6.A6.25 V11.01.05.25_08-21-2015 in "/sws.login/gnb/loginView.sws" in multiple parameters: contextpath and basedURL.
• CVE-2019-7420, published 2019-03-21. Medium severity, CVSS 6.1. EPSS: 1.5% chance of exploitation in the next 30 days. XSS exists in SAMSUNG X7400GX SyncThru Web Service V6.A6.25 V11.01.05.25_08-21-2015 in "/sws.application/information/networkinformationView.sws" in the tabName parameter.
• CVE-2019-7419, published 2019-03-21. Medium severity, CVSS 6.1. EPSS: 1.5% chance of exploitation in the next 30 days. XSS exists in SAMSUNG X7400GX SyncThru Web Service V6.A6.25 V11.01.05.25_08-21-2015 in "/sws/leftmenu.sws" in multiple parameters: ruiFw_id, ruiFw_pid, ruiFw_title.
• CVE-2018-14904, published 2018-08-03. Medium severity, CVSS 6.1. EPSS: 0.7% chance of exploitation in the next 30 days. Samsung Syncthru Web Service V4.05.61 is vulnerable to Multiple unauthenticated XSS attacks on several parameters, as demonstrated by ruiFw_pid.
• CVE-2021-35309, published 2023-08-22. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. An issue discovered in Samsung SyncThru Web Service SPL 5.93 06-09-2014 allows attackers to gain escalated privileges via MITM attacks.
• CVE-2018-14908, published 2018-08-03. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. Samsung Syncthru Web Service V4.05.61 is vulnerable to CSRF on every request, as demonstrated by sws.application/printinformation/printReportSetupView.sws for a "Print emails sent" action.