CVE-2023-0142

published 2023-06-13

CVE-2023-0142: Uncontrolled search path element vulnerability in Backup Management functionality in Synology DiskStation Manager (DSM) before 6.2.4-25556-8, 7.0.1-42218-7 and…

Priority P3 47 high 8.1 CVSS 3.1

AV N AC L PR L UI N S U C H I H A N

Uncontrolled search path element vulnerability in Backup Management functionality in Synology DiskStation Manager (DSM) before 6.2.4-25556-8, 7.0.1-42218-7 and 7.1-42661 allows remote authenticated users with administrator privileges to read or write arbitrary files via unspecified vectors.

Affected

10 ranges

Vendor	Product	Version range	Fixed in
synology	diskstation_manager	>= 6.2 < 6.2.4-25556-8	6.2.4-25556-8
synology	diskstation_manager	>= 6.2 < 7.1-42661	7.1-42661
synology	diskstation_manager	>= 7.0 < 7.0.1-42218-7	7.0.1-42218-7
synology	diskstation_manager	>= 7.1 < 7.1-42661	7.1-42661
synology	diskstation_manager_unified_controller	—	—
synology	router_manager	—	—
synology	router_manager	>= 1.2 < 1.3.1-9346	1.3.1-9346
synology	synology_router_manager	>= 1.2 < 1.2.*	1.2.*
synology	synology_router_manager	>= 1.3 < 1.3.*	1.3.*
synology	unified_controller	>= 3.1 < 3.1.*	3.1.*

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-427