| CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
|---|---|---|
| 8.4 | $0-$5k | 0.00 |
Summary
A vulnerability was found in Synology DS107 and DS116. It has been classified as critical. Affected by this issue is some unknown functionality. This manipulation causes credentials management. This vulnerability is handled as CVE-2016-6554. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is recommended.
Details
A vulnerability has been found in Synology DS107 and DS116 (unknown version) and classified as critical. Affected by this vulnerability is an unknown code block. The manipulation with an unknown input leads to a credentials management vulnerability. The CWE definition for the vulnerability is CWE-255. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:
Synology NAS servers DS107, firmware version 3.1-1639 and prior, and DS116, DS213, firmware versions prior to 5.2-5644-1, use non-random default credentials of: guest:(blank) and admin:(blank) . A remote network attacker can gain privileged access to a vulnerable device.
The bug was discovered 10/20/2016. The weakness was released 07/13/2018 by Ory Segal as confirmed advisory (CERT.org). The advisory is shared at kb.cert.org. This vulnerability is known as CVE-2016-6554 since 08/03/2016. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1552 for this issue.
The vulnerability was handled as a non-public zero-day exploit for at least 631 days. During that time the estimated underground price was around $0-$5k.
Upgrading eliminates this vulnerability.
The vulnerability is also documented in the vulnerability database at SecurityFocus (BID 93805†). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Product
Vendor
Name
License
Website
- Vendor: https://www.synology.com/
CPE 2.3
CPE 2.2
CVSSv4
VulDB Vector: 🔍VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 8.5VulDB Meta Temp Score: 8.4
VulDB Base Score: 7.3
VulDB Temp Score: 7.0
VulDB Vector: 🔍
VulDB Reliability: 🔍
NVD Base Score: 9.8
NVD Vector: 🔍
CVSSv2
| AV | AC | Au | C | I | A |
|---|---|---|---|---|---|
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
|---|---|---|---|---|---|
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
NVD Base Score: 🔍
Exploiting
Class: Credentials managementCWE: CWE-255
CAPEC: 🔍
ATT&CK: 🔍
Physical: No
Local: No
Remote: Yes
Availability: 🔍
Status: Not defined
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
| 0-Day | Unlock | Unlock | Unlock | Unlock |
|---|---|---|---|---|
| Today | Unlock | Unlock | Unlock | Unlock |
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: UpgradeStatus: 🔍
0-Day Time: 🔍
Timeline
08/03/2016 🔍10/20/2016 🔍
10/20/2016 🔍
07/13/2018 🔍
07/13/2018 🔍
07/14/2018 🔍
12/27/2024 🔍
Sources
Vendor: synology.comAdvisory: kb.cert.org
Researcher: Ory Segal
Status: Confirmed
Confirmation: 🔍
CVE: CVE-2016-6554 (🔍)
GCVE (CVE): GCVE-0-2016-6554
GCVE (VulDB): GCVE-100-121441
CERT: 🔍
SecurityFocus: 93805 - Multiple Synology DiskStation Products CVE-2016-6554 Insecure Default Password Vulnerability
Entry
Created: 07/14/2018 13:54Updated: 12/27/2024 05:59
Changes: 07/14/2018 13:54 (63), 03/04/2020 21:23 (1), 12/27/2024 05:59 (18)
Complete: 🔍
Cache ID: 216::103
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
No comments yet. Languages: en.
Please log in to comment.