CVE-2016-6554 - OpenCVE

Synology NAS servers DS107, firmware version 3.1-1639 and prior, and DS116, DS213, firmware versions prior to 5.2-5644-1, use non-random default credentials of: guest:(blank) and admin:(blank) . A remote network attacker can gain privileged access to a vulnerable device.

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Complete

Integrity Impact Complete

Availability Impact Complete

AV:N/AC:L/Au:N/C:C/I:C/A:C

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Synology	Ds107 Ds107 Firmware Ds116 Ds116 Firmware Ds213 Ds213 Firmware

Configuration 1 [-]

AND

cpe:2.3:o:synology:ds107_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:synology:ds107:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:synology:ds213_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:synology:ds213:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:o:synology:ds116_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:synology:ds116:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://www.kb.cert.org/vuls/id/404187
https://www.securityfocus.com/bid/93805
https://www.synology.com/en-global/releaseNote/DS213

History

No history.

MITRE

Status: PUBLISHED

Assigner: certcc

Published: 2018-07-13T20:00:00

Updated: 2024-08-06T01:36:28.402Z

Reserved: 2016-08-03T00:00:00

Link: CVE-2016-6554

Vulnrichment

No data.

NVD

Status : Modified

Published: 2018-07-13T20:29:00.753

Modified: 2019-10-09T23:19:15.080

Link: CVE-2016-6554

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "NAS server DS107", "vendor": "Synology", "versions": [{"lessThanOrEqual": "3.1-1639", "status": "affected", "version": "3.1-1639", "versionType": "custom"}]}, {"product": "NAS server DS116", "vendor": "Synology", "versions": [{"lessThan": "5.2-5644-1", "status": "affected", "version": "5.2-5644-1", "versionType": "custom"}]}, {"product": "NAS server DS213", "vendor": "Synology", "versions": [{"lessThan": "5.2-5644-1", "status": "affected", "version": "5.2-5644-1", "versionType": "custom"}]}], "datePublic": "2016-10-20T00:00:00", "descriptions": [{"lang": "en", "value": "Synology NAS servers DS107, firmware version 3.1-1639 and prior, and DS116, DS213, firmware versions prior to 5.2-5644-1, use non-random default credentials of: guest:(blank) and admin:(blank) . A remote network attacker can gain privileged access to a vulnerable device."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-255", "description": "CWE-255", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2018-07-13T19:57:01", "orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://www.synology.com/en-global/releaseNote/DS213"}, {"name": "93805", "tags": ["vdb-entry", "x_refsource_BID"], "url": "https://www.securityfocus.com/bid/93805"}, {"name": "VU#404187", "tags": ["third-party-advisory", "x_refsource_CERT-VN"], "url": "https://www.kb.cert.org/vuls/id/404187"}], "source": {"discovery": "UNKNOWN"}, "title": "Synology NAS servers DS107, DS116, and DS213, use default credentials", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cert@cert.org", "ID": "CVE-2016-6554", "STATE": "PUBLIC", "TITLE": "Synology NAS servers DS107, DS116, and DS213, use default credentials"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "NAS server DS107", "version": {"version_data": [{"affected": "<=", "version_affected": "<=", "version_name": "3.1-1639", "version_value": "3.1-1639"}]}}, {"product_name": "NAS server DS116", "version": {"version_data": [{"affected": "<", "version_affected": "<", "version_name": "5.2-5644-1", "version_value": "5.2-5644-1"}]}}, {"product_name": "NAS server DS213", "version": {"version_data": [{"affected": "<", "version_affected": "<", "version_name": "5.2-5644-1", "version_value": "5.2-5644-1"}]}}]}, "vendor_name": "Synology"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Synology NAS servers DS107, firmware version 3.1-1639 and prior, and DS116, DS213, firmware versions prior to 5.2-5644-1, use non-random default credentials of: guest:(blank) and admin:(blank) . A remote network attacker can gain privileged access to a vulnerable device."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-255"}]}]}, "references": {"reference_data": [{"name": "https://www.synology.com/en-global/releaseNote/DS213", "refsource": "CONFIRM", "url": "https://www.synology.com/en-global/releaseNote/DS213"}, {"name": "93805", "refsource": "BID", "url": "https://www.securityfocus.com/bid/93805"}, {"name": "VU#404187", "refsource": "CERT-VN", "url": "https://www.kb.cert.org/vuls/id/404187"}]}, "source": {"discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T01:36:28.402Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.synology.com/en-global/releaseNote/DS213"}, {"name": "93805", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "https://www.securityfocus.com/bid/93805"}, {"name": "VU#404187", "tags": ["third-party-advisory", "x_refsource_CERT-VN", "x_transferred"], "url": "https://www.kb.cert.org/vuls/id/404187"}]}]}, "cveMetadata": {"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "assignerShortName": "certcc", "cveId": "CVE-2016-6554", "datePublished": "2018-07-13T20:00:00", "dateReserved": "2016-08-03T00:00:00", "dateUpdated": "2024-08-06T01:36:28.402Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:synology:ds107_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "7A2AA0A5-7D6B-4B9B-A54B-C1B561C65B6E", "versionEndIncluding": "3.1-1639", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:synology:ds107:-:*:*:*:*:*:*:*", "matchCriteriaId": "B0D83E40-4929-42F3-B9E7-1B82233BE138", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:synology:ds213_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "2F6CFD73-436F-4C23-8341-1DA338DC7556", "versionEndIncluding": "5.2-5644-1", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:synology:ds213:-:*:*:*:*:*:*:*", "matchCriteriaId": "83017CD5-CA82-4AD3-8F04-D978484B6549", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:synology:ds116_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "366B0C72-D31D-47B9-87AE-35C6549A9615", "versionEndIncluding": "5.2-5644-1", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:synology:ds116:-:*:*:*:*:*:*:*", "matchCriteriaId": "2002CCA0-9DF0-4D74-8046-D54049442203", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Synology NAS servers DS107, firmware version 3.1-1639 and prior, and DS116, DS213, firmware versions prior to 5.2-5644-1, use non-random default credentials of: guest:(blank) and admin:(blank) . A remote network attacker can gain privileged access to a vulnerable device."}, {"lang": "es", "value": "Los servidores Synology NAS DS107, en versiones de firmware 3.1-1639 y anteriores; y DS116 y DS213, en versiones de firmware anteriores a la 5.2-5644-1, emplea credenciales por defecto no aleatorias de: uest:(en blanco) y admin:(en blanco) . Un atacante remoto en la red puede obtener acceso privilegiado a un dispositivo vulnerable."}], "id": "CVE-2016-6554", "lastModified": "2019-10-09T23:19:15.080", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 10.0, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2018-07-13T20:29:00.753", "references": [{"source": "cret@cert.org", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://www.kb.cert.org/vuls/id/404187"}, {"source": "cret@cert.org", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://www.securityfocus.com/bid/93805"}, {"source": "cret@cert.org", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://www.synology.com/en-global/releaseNote/DS213"}], "sourceIdentifier": "cret@cert.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-255"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-255"}], "source": "cret@cert.org", "type": "Secondary"}]}