CVE-2022-27625 - Vulnerability Details - OpenCVE

A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the message processing functionality of Out-of-Band (OOB) Management. This allows remote attackers to execute arbitrary commands via unspecified vectors. The following models with Synology DiskStation Manager (DSM) versions before 7.1.1-42962-2 may be affected: DS3622xs+, FS3410, and HD6500.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Synology	Diskstation Manager Ds3622xs\+ Fs3410 Hd6500

Configuration 1 [-]

AND

cpe:2.3:o:synology:diskstation_manager:*:*:*:*:*:*:*:*

OR	cpe:2.3:h:synology:ds3622xs\+:-:::::::*
	cpe:2.3:h:synology:fs3410:-:::::::*
	cpe:2.3:h:synology:hd6500:-:::::::*

No data.

References

Link	Providers
https://www.synology.com/security/advisory/Synology_SA_22_17

History

Tue, 14 Jan 2025 19:45:00 +0000

Type	Values Removed	Values Added
CPEs	cpe:2.3:a:synology:diskstation_manager::::::::	cpe:2.3:o:synology:diskstation_manager::::::::

MITRE

Status: PUBLISHED

Assigner: synology

Published: 2022-10-20T05:50:14.818052Z

Updated: 2024-09-17T04:09:49.703Z

Reserved: 2022-03-21T00:00:00

Link: CVE-2022-27625

Vulnrichment

No data.

NVD

Status : Modified

Published: 2022-10-20T06:15:11.360

Modified: 2025-01-14T19:29:55.853

Link: CVE-2022-27625

Redhat

No data.

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:synology:diskstation_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "E661755F-1521-4315-9E32-615148BAEF78", "versionEndExcluding": "7.1.1-42962-2", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:synology:ds3622xs\\+:-:*:*:*:*:*:*:*", "matchCriteriaId": "CBC3E0E3-868D-4A35-A87D-37E0C79A0702", "vulnerable": false}, {"criteria": "cpe:2.3:h:synology:fs3410:-:*:*:*:*:*:*:*", "matchCriteriaId": "0C86BD06-9795-4AF0-9D44-F66D2C555A08", "vulnerable": false}, {"criteria": "cpe:2.3:h:synology:hd6500:-:*:*:*:*:*:*:*", "matchCriteriaId": "B397D029-DBFA-477B-B2ED-CFC4C66821EB", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the message processing functionality of Out-of-Band (OOB) Management. This allows remote attackers to execute arbitrary commands via unspecified vectors. The following models with Synology DiskStation Manager (DSM) versions before 7.1.1-42962-2 may be affected: DS3622xs+, FS3410, and HD6500."}, {"lang": "es", "value": "Se ha encontrado una vulnerabilidad relativa a la restricci\u00f3n inapropiada de operaciones dentro de los l\u00edmites de un b\u00fafer de memoria en la funcionalidad message processing de Out-of-Band (OOB) Management. Esto permite a atacantes remotos ejecutar comandos arbitrarios por medio de vectores no especificados. Los siguientes modelos con Synology DiskStation Manager (DSM) versiones anteriores a 7.1.1-42962-2 pueden estar afectados: DS3622xs+, FS3410 y HD6500"}], "id": "CVE-2022-27625", "lastModified": "2025-01-14T19:29:55.853", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 6.0, "source": "security@synology.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-10-20T06:15:11.360", "references": [{"source": "security@synology.com", "tags": ["Vendor Advisory"], "url": "https://www.synology.com/security/advisory/Synology_SA_22_17"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.synology.com/security/advisory/Synology_SA_22_17"}], "sourceIdentifier": "security@synology.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-119"}], "source": "security@synology.com", "type": "Primary"}]}