CVE-2017-12078 HIGH

CVE-2017-12078

Vendor Synology

Product Synology Router Manager (SRM)

Weakness CWE-77

Published June 8, 2018

Last update September 17, 2024

View on NVD All CVEs

CVSS base score

7.2/10

Attack vector Network

Attack complexity Low

Privileges required High

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Command injection vulnerability in EZ-Internet in Synology Router Manager (SRM) before 1.1.6-6931 allows remote authenticated users to execute arbitrary command via the username parameter.

Key dates

02Disclosure timeline

June 8, 2018 CVE published

September 17, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2017-12078 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/77.html

Related vulnerabilities

04Related CVE

CVE-2026-34259 OS Command Injection Vulnerability in SAP Forecasting & Replenishment CVE-2025-3541 H3C Magic NX15/Magic NX30 Pro/Magic NX400/Magic R3010 HTTP POST Request getSpecs FCGI_WizardProtoProcess command injection CVE-2025-0593 SICK Lector8xx and InspectorP8xx vulnerable for code execution CVE-2026-1638 Tenda AC21 mDMZSetCfg command injection CVE-2024-52011 launch-editor vulnerable to command injection via the crafted request on Windows

Identifiers

CVE CVE-2017-12078

CWE CWE-77

CVSS 7.2 / HIGH

Affected versions

Vendor Synology

Product Synology Router Manager (SRM)

Affected ≥ unspecified and < 1.1.6-6931