CVE-2017-11156
high
CVSS v3
7.8
CVSS v4 NEW
—
VIR risk
7.8
Description
Synology Download Station 3.8.x before 3.8.5-3475 and 3.x before 3.5-2984 uses weak permissions (0777) for ui/dlm/btsearch directory, which allows remote authenticated users to execute arbitrary code by uploading an executable via unspecified vectors.
Predictions
Exploit likelihood
75%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
No mitigations published for this CVE yet.
The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.
✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here withsource_tier=community-verified.
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| synology | download_station | 3.2-2295 | |
| synology | download_station | 3.3-2382 | |
| synology | download_station | 3.3-2383 | |
| synology | download_station | 3.3-2386 | |
| synology | download_station | 3.4-2477 | |
| synology | download_station | 3.4-2478 | |
| synology | download_station | 3.4-2480 | |
| synology | download_station | 3.4-2485 | |
| synology | download_station | 3.4-2486 | |
| synology | download_station | 3.4-2489 | |
| synology | download_station | 3.4-2490 | |
| synology | download_station | 3.4-2514 | |
| synology | download_station | 3.4-2555 | |
| synology | download_station | 3.4-2557 | |
| synology | download_station | 3.4-2558 | |
| synology | download_station | 3.5-2638 | |
| synology | download_station | 3.5-2705 | |
| synology | download_station | 3.5-2706 | |
| synology | download_station | 3.5-2955 | |
| synology | download_station | 3.5-2956 | |
| synology | download_station | 3.5-2962 | |
| synology | download_station | 3.5-2963 | |
| synology | download_station | 3.5-2967 | |
| synology | download_station | 3.5-2968 | |
| synology | download_station | 3.5-2970 | |
| synology | download_station | 3.5-2973 | |
| synology | download_station | 3.5-2980 | |
| synology | download_station | 3.5-2982 | |
| synology | download_station | 3.8.0-3416 | |
| synology | download_station | 3.8.1-3420 | |
| synology | download_station | 3.8.2-3455 | |
| synology | download_station | 3.8.3-3458 | |
| synology | download_station | 3.8.4-3468 | |
References
CWEs
CWE-276 CWE-732
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.