Synology DiskStation Manager is prone to a remote command-execution vulnerability.

An attacker can exploit this issue to execute arbitrary commands with root privileges.

Updates are available.

Synology DiskStation Manager (DSM) contains a flaw in the SliceUpload functionality provided by /webman/imageSelector.cgi. With a specially crafted request, a remote attacker can append data to files, allowing for the execution of arbitrary commands.

Synology DiskStation Manager 4.x are vulnerable other versions may also be affected.

This script tries to execute the 'id' command on the remote host using specially crafted requests.

• http://www.securityfocus.com/bid/64516

---

Updated on 2015-03-25