CVE-2017-11153 Deserialization in Synology Photo Station

Critical 9.8 Published 8 Aug 2017 Updated 16 Sep 2024

Remote attackers can gain administrator privileges via a crafted serialized payload in Synology Photo Station.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2017-11153?

CVE-2017-11153 is a critical unsafe deserialization vulnerability in Synology Photo Station, published on 8 Aug 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Deserialization vulnerability in synophoto_csPhotoMisc.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to gain administrator privileges via a crafted serialized payload.

Weakness: CWE-502

Which versions are affected by CVE-2017-11153?

It affects 1 product.

Products include Synology Photo Station.

How do I fix CVE-2017-11153?

No fix has been published for CVE-2017-11153 yet. Limit exposure of the affected software until one is available.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2017-11153 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2017-11153 exists.

Public exploit code: 1 Exploit-DB entry.

Sources

Also known as GHSA-x792-xp3f-8cmm.