CVE-2017-15889: Synology DSM smart.cgi command injection via disk field

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityHigh CVSS (8.8) with public exploit code and very high EPSS, though exploitation requires valid credentials and no KEV listing exists.

What it is

Synology DiskStation Manager (DSM) before 5.2-5967-5 contains a command injection flaw in smart.cgi. The disk field is passed to a shell without adequate sanitization, letting an authenticated remote user run arbitrary commands on the NAS. Because DSM is widely deployed for storage and backup, a compromised NAS can expose stored data and serve as a foothold into the network.

Impact

An attacker with valid credentials gains arbitrary command execution on the DSM host, typically as the web service account, enabling data theft, tampering with stored files, and lateral movement. CVSS 3.0 scores confidentiality, integrity and availability all High (8.8).

Attack surface

Reached over the network through the smart.cgi web endpoint (AV:N, AC:L). Authentication is required (PR:L) and no user interaction is needed (UI:N).

Exploitation

Not listed in CISA KEV and no ransomware associations are recorded. EPSS is very high (0.73691, 99.4th percentile), and public references include a Packet Storm remote command execution write-up alongside the vendor advisory, indicating exploit code is publicly available.

What to do

• Upgrade DSM to 5.2-5967-5 or later per Synology advisory SA_17_65_DSM.
• Restrict access to DSM management interfaces to trusted networks or VPN; do not expose them to the internet.
• Enforce least privilege and strong authentication for DSM accounts, and remove unused accounts.
• Monitor and rotate credentials for any account with access to smart.cgi or administrative functions.

Detection

• Inspect web logs for requests to smart.cgi with shell metacharacters or unexpected values in the disk parameter.
• Alert on child processes spawned by the DSM web service (e.g., shell or command interpreters) outside normal maintenance windows.
• Review DSM audit logs for unusual authenticated sessions or command activity tied to storage/disk operations.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.