CVE-2018-13285

EUVD-2018-5233
Command injection vulnerability in ftpd in Synology Router Manager (SRM) before 1.1.7-6941-1 allows remote authenticated users to execute arbitrary OS commands via the (1) MKD or (2) RMD command.
OS Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
HIGH
LOW
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
synologyCNA
7.5 HIGH
NETWORK
HIGH
LOW
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 78%
Affected Products (NVD)
VendorProductVersion
synologyrouter_manager
1.1 ≤
𝑥
< 1.1.7-6941-1
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://www.synology.com/security/advisory/Synology_SA_18_34
https://www.synology.com/security/advisory/Synology_SA_18_34