CVE-2018-13285

EUVD-2018-5233 · Published Apr 1, 2019

Command injection vulnerability in ftpd in Synology Router Manager (SRM) before 1.1.7-6941-1 allows remote authenticated users to execute arbitrary OS commands via the (1) MKD or (2) RMD command.

Technologies

Synology Router Manager

Weaknesses

CWE-78

CVSS scores

v3.08.8CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
v2.09.0AV:N/AC:L/Au:S/C:C/I:C/A:C

MITRE ATT&CK

Inferred

Where this vulnerability fits in an attack

ReconImpact

Initial Access

T1190Exploit Public-Facing Application

References

https://www.synology.com/security/advisory/Synology_SA_18_34

Potentially impacted assets

See if this affects your attack surface