Vulnerability · Published Oct 20, 2022 · Assigned by synology

CVE-2022-3576

Medium 5.3

In plain English

A medium-severity out-of-bounds read in DiskStation Manager (DSM) from Synology. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 69% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)1.2%top 31.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability regarding out-of-bounds read is found in the session processing functionality of Out-of-Band (OOB) Management. This allows remote attackers to obtain sensitive information via unspecified vectors. The following models with Synology DiskStation Manager (DSM) versions before 7.1.1-42962-2 may be affected: DS3622xs+, FS3410, and HD6500.

Affected products (as reported)

Vendor	Product	Versions
Synology	DiskStation Manager (DSM)	unspecified – before 7.1.1-42962-2

Weakness: CWE-125 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

https://www.synology.com/security/advisory/Synology_SA_22_17