CVE-2021-34810 CRITICAL

CVE-2021-34810

Vendor Synology
Product Download Station
Weakness CWE-269
Published June 18, 2021
Last update September 16, 2024
View on NVD All CVEs

CVSS base score

9.9/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

Improper privilege management vulnerability in cgi component in Synology Download Station before 3.8.16-3566 allows remote authenticated users to execute arbitrary code via unspecified vectors.

Key dates

02Disclosure timeline

June 18, 2021 CVE published
September 16, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-40548 SolarWinds Serv-U Broken Access Control - Remote Code Execution Vulnerability CVE-2023-52209 WordPress WPForms User Registration plugin <= 2.1.0 - Authenticated Privilege Escalation vulnerability CVE-2021-1371 Cisco IOS XE SD-WAN Software Console Privilege Escalation Vulnerability CVE-2025-47411 Apache StreamPipes: Leverage of User ID for Privilege Escalation CVE-2023-51476 WordPress WP MLM Unilevel plugin <= 4.0 - Unauthenticated Account Takeover vulnerability