CVE-2022-36534: Super Flexible Software GmbH & Co. KG Syncovery 9 for Linux v9.47x and below was discovered to contain multiple remote code execution (RCE) vulnerabilities via…

PriorityP276high8.8CVSS 3.1

AVNACLPRLUINSUCHIHAH

EXPLOIT

EPSS

54.24%

98.9th percentile

Super Flexible Software GmbH & Co. KG Syncovery 9 for Linux v9.47x and below was discovered to contain multiple remote code execution (RCE) vulnerabilities via the Job_ExecuteBefore and Job_ExecuteAfter parameters at post_profilesettings.php.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
syncovery	syncovery	>= 8.00 < 9.48j	9.48j

Detection & IOCsextracted from sources · hover to see the quote

pathpost_profilesettings.php↗

→Monitor HTTP POST requests to post_profilesettings.php containing the Job_ExecuteBefore or Job_ExecuteAfter parameters with shell command syntax — these parameters accept arbitrary OS commands executed as root. ↗
→Alert on Syncovery web GUI sessions (authenticated) that create or modify jobs followed by immediate profile execution and subsequent log/profile deletion — a pattern used to disguise exploitation. ↗
→Any process spawned as root from the Syncovery web service (e.g., child shell processes) should be treated as suspicious and investigated for command injection via Job_ExecuteBefore/Job_ExecuteAfter. ↗

·Exploitation requires valid credentials (username/password) or a session token — unauthenticated exploitation is not possible. Detection should account for abuse of legitimate authenticated sessions. ↗
·All Syncovery versions prior to v9.48j are vulnerable, including ALL versions of branch 8 — patch coverage must include branch 8 deployments which have no fix available in-branch. ↗
·The vulnerability is Linux-platform specific; Windows deployments of Syncovery are not confirmed affected by this CVE. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.