CVE-2022-27624 - OpenCVE

A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the packet decryption functionality of Out-of-Band (OOB) Management. This allows remote attackers to execute arbitrary commands via unspecified vectors. The following models with Synology DiskStation Manager (DSM) versions before 7.1.1-42962-2 may be affected: DS3622xs+, FS3410, and HD6500.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Synology	Diskstation Manager Ds3622xs\+ Fs3410 Hd6500

Configuration 1 [-]

AND

cpe:2.3:a:synology:diskstation_manager:*:*:*:*:*:*:*:*

OR	cpe:2.3:h:synology:ds3622xs\+:-:::::::*
	cpe:2.3:h:synology:fs3410:-:::::::*
	cpe:2.3:h:synology:hd6500:-:::::::*

No data.

References

Link	Providers
https://www.synology.com/security/advisory/Synology_SA_22_17

History

No history.

MITRE

Status: PUBLISHED

Assigner: synology

Published: 2022-10-20T05:50:20.654212Z

Updated: 2024-09-17T03:18:51.141Z

Reserved: 2022-03-21T00:00:00

Link: CVE-2022-27624

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2022-10-20T06:15:09.620

Modified: 2022-10-21T15:51:25.487

Link: CVE-2022-27624

Redhat

No data.

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:synology:diskstation_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "DB78E4FF-42C9-4EDE-8578-0101CF87F7CA", "versionEndExcluding": "7.1.1-42962-2", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:synology:ds3622xs\\+:-:*:*:*:*:*:*:*", "matchCriteriaId": "CBC3E0E3-868D-4A35-A87D-37E0C79A0702", "vulnerable": false}, {"criteria": "cpe:2.3:h:synology:fs3410:-:*:*:*:*:*:*:*", "matchCriteriaId": "0C86BD06-9795-4AF0-9D44-F66D2C555A08", "vulnerable": false}, {"criteria": "cpe:2.3:h:synology:hd6500:-:*:*:*:*:*:*:*", "matchCriteriaId": "B397D029-DBFA-477B-B2ED-CFC4C66821EB", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the packet decryption functionality of Out-of-Band (OOB) Management. This allows remote attackers to execute arbitrary commands via unspecified vectors. The following models with Synology DiskStation Manager (DSM) versions before 7.1.1-42962-2 may be affected: DS3622xs+, FS3410, and HD6500."}, {"lang": "es", "value": "Se ha encontrado una vulnerabilidad relativa a la restricci\u00f3n inapropiada de operaciones dentro de los l\u00edmites de un b\u00fafer de memoria en la funcionalidad de Out-of-Band (OOB) Management. Esto permite a atacantes remotos ejecutar comandos arbitrarios por medio de vectores no especificados. Los siguientes modelos con Synology DiskStation Manager (DSM) versiones anteriores a 7.1.1-42962-2 pueden estar afectados: DS3622xs+, FS3410 y HD6500"}], "id": "CVE-2022-27624", "lastModified": "2022-10-21T15:51:25.487", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 6.0, "source": "security@synology.com", "type": "Secondary"}]}, "published": "2022-10-20T06:15:09.620", "references": [{"source": "security@synology.com", "tags": ["Vendor Advisory"], "url": "https://www.synology.com/security/advisory/Synology_SA_22_17"}], "sourceIdentifier": "security@synology.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-119"}], "source": "security@synology.com", "type": "Primary"}]}