CVE-2017-9552

A design flaw in authentication in Synology Photo Station 6.0-2528 through 6.7.1-3419 allows local users to obtain credentials via cmdline. Synology Photo Station employs the synophoto_dsm_user program to authenticate username and password by "synophoto_dsm_user --auth USERNAME PASSWORD", and local users are able to obtain credentials by sniffing "/proc/*/cmdline".

• CWE-522
• CWE-287

• http://blog.crozat.net/2017/06/synology-photostation-password-vulnerabilty.htmlIssue Tracking, Third Party Advisory
• https://www.synology.com/en-global/support/security/Photo_Station_CVE_2017_9552Third Party Advisory
• http://blog.crozat.net/2017/06/synology-photostation-password-vulnerabilty.htmlIssue Tracking, Third Party Advisory
• https://www.synology.com/en-global/support/security/Photo_Station_CVE_2017_9552Third Party Advisory

Published

Jun 13, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-9544There is a remote stack-based buffer overflow (SEH) in regis…9.8
• CVE-2017-9545The next_text function in src/libmpg123/id3.c in mpg123 1.24…
• CVE-2017-9546admin.php in BigTree through 4.2.18 allows remote authentica…
• CVE-2017-9547admin.php in BigTree through 4.2.18 has a Cross-site Scripti…
• CVE-2017-9548admin.php in BigTree through 4.2.18 has a Cross-site Scripti…
• CVE-2017-9551Mahara 15.04 before 15.04.14 and 16.04 before 16.04.8 and 16…
• CVE-2017-9553A design flaw in SYNO.API.Encryption in Synology DiskStation…
• CVE-2017-9554An information exposure vulnerability in forget_passwd.cgi i…
• CVE-2017-9555Cross-site scripting (XSS) vulnerability in PixlrEditorHandl…
• CVE-2017-9556Cross-site scripting (XSS) vulnerability in Video Metadata E…
• CVE-2017-9557register.ghp in EFS Software Easy Chat Server versions 2.0 t…7.5
• CVE-2017-9558The wawa-employees-credit-union-mobile/id1158082793 app 4.0.…