Synology-SA-24:19 Synology Photos (PWN2OWN 2024)

Publish Time: 2024-10-25 13:55:04 UTC+8

Last Updated: 2024-11-01 14:14:05 UTC+8

Severity
Critical
Status
Resolved

Abstract

A vulnerability allows remote attackers to execute arbitrary code.

The vulnerability reported by PWN2OWN 2024 (ZDI-CAN-25623) has been addressed.

Affected Products

Product Severity Fixed Release Availability
Synology Photos 1.7 for DSM 7.2 Critical Upgrade to 1.7.0-0795 or above.
Synology Photos 1.6 for DSM 7.2 Critical Upgrade to 1.6.2-0720 or above.

Mitigation

None

Detail

Reserved

Acknowledgement

Rick de Jager, Security Researcher at Midnight Blue

Revision

Revision Date Description
1 2024-10-25 Initial public release.
2 2024-11-01 Updated Acknowledgement for the researcher.