Stack-based buffer overflow in DiskStation Manager (DSM) - CVE-2021-26561
Published: April 20, 2021
Vulnerability identifier: #VU52349
CSH Severity: High
CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-26561
CWE-ID: CWE-121
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing "syno_finder_site" HTTP header. A remote unauthenticated attacker can perform a man-in-the-middle attack, trigger stack-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Affected software
DiskStation Manager (DSM)
How to mitigate CVE-2021-26561
Install update from vendor's website.
DiskStation Manager (DSM) - update to 6.2.3-25426-3