CVE-2015-6912

High

Published: 11/09/2015(UTC)Translated: 16/06/2026(UTC)NVD NIST

Summary

Synology Video Station before 1.5-0763 allows remote attackers to execute arbitrary shell commands via shell metacharacters in the subtitle_codepage parameter to subtitle.cgi.

Risk Assessment

An attacker could exploit this vulnerability to execute remote code, potentially leading to system compromise.

Recommendation

It is recommended to update Synology Video Station to the latest version to mitigate this vulnerability.

Other vulnerabilities in Synology Video Station

See all

CVE-2015-6911High
CVE-2015-6911 in Synology Video Station before version 1.5-0763 contains an SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands via the id parameter in watchstatus.cgi.
CVE-2015-6910High
CVE-2015-6910 is an SQL injection vulnerability in Synology Video Station before version 1.5-0757 that allows remote attackers to execute arbitrary SQL commands via the id parameter to audiotrack.cgi.

Original NVD description (English source)

Synology Video Station before 1.5-0763 allows remote attackers to execute arbitrary shell commands via shell metacharacters in the subtitle_codepage parameter to subtitle.cgi.