Synology Virtual Diskstation Manager vulnerabilities

3 CVEs affecting Synology Virtual Diskstation Manager, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2018-7185, published 2018-03-06.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-7185, published 2018-03-06. High severity, CVSS 7.5. EPSS: 9% chance of exploitation in the next 30 days. The protocol engine in ntp 4.2.6 before 4.2.8p11 allows a remote attackers to cause a denial of service (disruption) by continually sending a packet with a zero-origin timestamp and source IP address…
CVE-2018-7184, published 2018-03-06. High severity, CVSS 7.5. EPSS: 8.6% chance of exploitation in the next 30 days. ntpd in ntp 4.2.8p4 before 4.2.8p11 drops bad packets before updating the "received" timestamp, which allows remote attackers to cause a denial of service (disruption) by sending a packet with a…
CVE-2018-7170, published 2018-03-06. Medium severity, CVSS 5.3. EPSS: 2.7% chance of exploitation in the next 30 days. ntpd in ntp 4.2.x before 4.2.8p7 and 4.3.x before 4.3.92 allows authenticated users that know the private symmetric key to create arbitrarily-many ephemeral associations in order to win the clock…