CVE-2017-11156
N/A
Published: August 14, 2017 at 07:00 PM UTC
Updated: June 17, 2026 at 01:01 AM UTC
1 product affected across 1 vendorDownload Station
Using Synology Download Station by Synology?
Get instant alerts when new vulnerabilities affect Synology Download Station - before attackers find them.
Real-time alertsTrack your software stackFree plan available
Severity
N/A
Exploit prediction
EPSS 2%
Description
Synology Download Station 3.8.x before 3.8.5-3475 and 3.x before 3.5-2984 uses weak permissions (0777) for ui/dlm/btsearch directory, which allows remote authenticated users to execute arbitrary code by uploading an executable via unspecified vectors.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
3.8 ≤ v < 3.8.5-34753.2-22953.3-23823.3-23833.3-23863.4-24773.4-24783.4-24803.4-24853.4-24863.4-24893.4-24903.4-25143.4-25553.4-25573.4-25583.5-26383.5-27053.5-27063.5-29553.5-29563.5-29623.5-29633.5-29673.5-29683.5-29703.5-29733.5-29803.5-29823.8.0-34163.8.1-34203.8.2-34553.8.3-34583.8.4-3468
Affected range stops below 3.8.5-3475, so it looks safe — our inference, not a vendor statement
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
Patch and advisory references
References (1)
x_refsource_CONFIRMVendor Advisory
Source: [email protected]
https://www.synology.com/en-global/support/security/Synology_SA_17_28_Download_StationQuick Info
StatusMODIFIED
CWE
CWE-276CWE-732
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.
Free plan, no card