Synology: Multiple products impacted by OpenSSL RCE vulnerability

guest · Aug 26, 2021

Synology: Multiple products impacted by OpenSSL RCE vulnerability
August 26, 2021
https://www.bleepingcomputer.com/ne...oducts-impacted-by-openssl-rce-vulnerability/

Taiwan-based NAS maker Synology has revealed that recently disclosed remote code execution (RCE) and denial-of-service (DoS) OpenSSL vulnerabilities impact some of its products.

"Multiple vulnerabilities allow remote attackers to conduct denial-of-service attack or execute arbitrary code via a susceptible version of Synology DiskStation Manager (DSM), Synology Router Manager (SRM), VPN Plus Server or VPN Server," the company explains in a security advisory published earlier today.
The complete list of devices affected by the security flaws tracked as CVE-2021-3711 and CVE-2021-3712 includes DSM 7.0, DSM 6.2, DSM UC, SkyNAS, VS960HD, SRM 1.2, VPN Plus Server, and VPN Server.

While Synology does not provide an estimated timeline for these incoming updates, the company told BleepingComputer earlier this month that it generally patches affected software within 90 days after publishing advisories.
Click to expand...

DiskStation Manager vulnerabilities also under investigation
The NAS maker is also working on security updates for multiple DiskStation Manager (DSM) vulnerabilities with no assigned CVE IDs and impacting DSM 7.0, DSM 6.2, DSM UC, SkyNAS, and VS960HD.

"Multiple vulnerabilities allow remote authenticated users to execute arbitrary commands, or remote attackers to write arbitrary files via a susceptible version of DiskStation Manager (DSM)," Synology said when it publicly disclosed these security flaws on August 17.
Click to expand...

Log in or Sign up

Synology: Multiple products impacted by OpenSSL RCE vulnerability

guest Guest

Log in or Sign up

Synology: Multiple products impacted by OpenSSL RCE vulnerability

guest Guest

Useful Searches