Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2021-34810: Improper privilege management vulnerability in cgi component in Synology Download Station before 3.8.16-3566 allows remote authenticated users to execute arbitrary code via unspecified vectors.

CVE-2021-34810 · published 5 years ago

Summary

Improper privilege management vulnerability in cgi component in Synology Download Station before 3.8.16-3566 allows remote authenticated users to execute arbitrary code via unspecified vectors.

What to do

Update synology download_station to version 3.8.16-3566 or later.

Affected software

Vendor	Product	Affected versions
synology	download_station	< 3.8.16-3566 `cpe:2.3:a:synology:download_station::::::::`

Original advisory text

Improper privilege management vulnerability in cgi component in Synology Download Station before 3.8.16-3566 allows remote authenticated users to execute arbitrary code via unspecified vectors.

References

https://www.synology.com/security/advisory/Synology_SA_21_11 Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

8.8 High

Exploitation

1% chance of attack within 30 days

Type

CWE-269Improper Privilege Management

Timeline

Published18 Jun 2021

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2021-34810 · NVD

Track software like this

Free during beta