CVE-2017-11160

High

Published: 18/08/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

Multiple untrusted search path vulnerabilities in the installer of Synology Assistant before version 6.1-15163 on Windows allow local attackers to execute arbitrary code and conduct DLL hijacking attacks using malicious files.

Risk Assessment

Attackers can exploit these vulnerabilities to run malicious code, potentially leading to system compromise or data theft.

Recommendation

It is recommended to update Synology Assistant to the latest version to mitigate these vulnerabilities and restrict installer access to trusted users.

Other vulnerabilities in Synology Assistant

CVE-2026-4793High
Synology Assistant before version 7.0.7-50095 has incorrect default permissions. A local user can read or write arbitrary files and perform a denial-of-service attack during installation.

Original NVD description (English source)

Multiple untrusted search path vulnerabilities in installer in Synology Assistant before 6.1-15163 on Windows allows local attackers to execute arbitrary code and conduct DLL hijacking attack via a Trojan horse (1) shfolder.dll, (2) ntmarta.dll, (3) secur32.dll or (4) dwmapi.dll file in the current working directory.