CVE-2023-0142

Summary

Uncontrolled search path element vulnerability in Backup Management functionality in Synology DiskStation Manager (DSM) before 6.2.4-25556-8, 7.0.1-42218-7 and 7.1-42661 allows remote authenticated users with administrator privileges to read or write arbitrary files via unspecified vectors.

Affected Software

VendorProductVersion RangeStatus
SynologyDiskStation Manager (DSM)7.2 < 7.2.*unaffected
SynologyDiskStation Manager (DSM)7.1 < 7.1-42661affected
SynologyDiskStation Manager (DSM)7.0 < 7.0.1-42218-7affected
SynologyDiskStation Manager (DSM)6.2 < 6.2.4-25556-8affected
SynologyDiskStation Manager (DSM)0 < 6.2unknown
SynologyUnified Controller (DSMUC)3.1 < 3.1.*affected
SynologyUnified Controller (DSMUC)0 < 3.1unknown
SynologySynology Router Manager (SRM)1.3 < 1.3.*affected
SynologySynology Router Manager (SRM)1.2 < 1.2.*affected
SynologySynology Router Manager (SRM)0 < 1.2unknown

Weaknesses

  • CWE-427: Uncontrolled Search Path Element

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References