CVE-2022-27626 - OpenCVE

A vulnerability regarding concurrent execution using shared resource with improper synchronization ('Race Condition') is found in the session processing functionality of Out-of-Band (OOB) Management. This allows remote attackers to execute arbitrary commands via unspecified vectors. The following models with Synology DiskStation Manager (DSM) versions before 7.1.1-42962-2 may be affected: DS3622xs+, FS3410, and HD6500.

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

Vendors & Products
CPE Configurations

Vendors	Products
Synology	Diskstation Manager Fs3410 Hd6500 Ds3622xs\+

Configuration 1 [-]

AND

cpe:2.3:a:synology:diskstation_manager:*:*:*:*:*:*:*:*

OR	cpe:2.3:h:synology:ds3622xs\+:-:::::::*
	cpe:2.3:h:synology:fs3410:-:::::::*
	cpe:2.3:h:synology:hd6500:-:::::::*

References

Link	Resource
https://www.synology.com/security/advisory/Synology_SA_22_17	Vendor Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: synology

Published: 2022-10-20T00:00:00

Updated: 2022-10-20T00:00:00

Reserved: 2022-03-21T00:00:00

Link: CVE-2022-27626

JSON object: View

NVD Information

Status : Analyzed

Published: 2022-10-20T06:15:11.857

Modified: 2022-10-21T15:57:41.150

Link: CVE-2022-27626

JSON object: View

Redhat Information

No data.

CWE

CWE-362

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:synology:diskstation_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "DB78E4FF-42C9-4EDE-8578-0101CF87F7CA", "versionEndExcluding": "7.1.1-42962-2", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:synology:ds3622xs\\+:-:*:*:*:*:*:*:*", "matchCriteriaId": "CBC3E0E3-868D-4A35-A87D-37E0C79A0702", "vulnerable": false}, {"criteria": "cpe:2.3:h:synology:fs3410:-:*:*:*:*:*:*:*", "matchCriteriaId": "0C86BD06-9795-4AF0-9D44-F66D2C555A08", "vulnerable": false}, {"criteria": "cpe:2.3:h:synology:hd6500:-:*:*:*:*:*:*:*", "matchCriteriaId": "B397D029-DBFA-477B-B2ED-CFC4C66821EB", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "A vulnerability regarding concurrent execution using shared resource with improper synchronization ('Race Condition') is found in the session processing functionality of Out-of-Band (OOB) Management. This allows remote attackers to execute arbitrary commands via unspecified vectors. The following models with Synology DiskStation Manager (DSM) versions before 7.1.1-42962-2 may be affected: DS3622xs+, FS3410, and HD6500."}, {"lang": "es", "value": "Se ha detectado una vulnerabilidad relativa a la ejecuci\u00f3n concurrente usando recursos compartidos con una sincronizaci\u00f3n inapropiada (\"Condici\u00f3n de Carrera\") en la funcionalidad session processing de Out-of-Band (OOB) Management. Esto permite a atacantes remotos ejecutar comandos arbitrarios por medio de vectores no especificados. Los siguientes modelos con Synology DiskStation Manager (DSM) versiones anteriores a 7.1.1-42962-2 pueden estar afectados: DS3622xs+, FS3410 y HD6500"}], "id": "CVE-2022-27626", "lastModified": "2022-10-21T15:57:41.150", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 6.0, "source": "security@synology.com", "type": "Secondary"}]}, "published": "2022-10-20T06:15:11.857", "references": [{"source": "security@synology.com", "tags": ["Vendor Advisory"], "url": "https://www.synology.com/security/advisory/Synology_SA_22_17"}], "sourceIdentifier": "security@synology.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-362"}], "source": "security@synology.com", "type": "Primary"}]}