CVE-2021-27649 Use after free in DiskStation Manager (DSM)

Critical 9.8 Published 23 Jun 2021 Updated 16 Sep 2024

Remote attackers can execute arbitrary code via a use-after-free flaw in the file transfer protocol component of Synology DSM.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-27649?

CVE-2021-27649 is a critical use after free vulnerability in Synology Diskstation Manager, published on 23 Jun 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Use after free vulnerability in file transfer protocol component in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via unspecified vectors.

Weakness: CWE-416

Which versions are affected by CVE-2021-27649?

It affects 2 products.

Products include Synology Diskstation Manager, Synology Diskstation Manager Unified Controller.

How do I fix CVE-2021-27649?

No fix has been published for CVE-2021-27649 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2021-27649 being exploited?

There is no known exploitation of CVE-2021-27649 in the wild and no public exploit code.

All Synology Diskstation Manager vulnerabilities

Sources

Also known as GHSA-59pm-73xx-3pvc.