synology photo station

Name: synology photo station
Brand: synology

productUS

cpe:2.3:a:synology:photo_station:*:*:*:*:*:*:*:*

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

by severity

6critical15high12medium0low

updated 2026-10-28

vulnerabilities (33)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2017-11155US	high7.5	47.4% (99th)	Exploit	no fix	2017-08-08	2 versions
CVE-2017-11151US	critical9.8	16.3% (97th)	Exploit	no fix	2017-08-08	2 versions
CVE-2017-11152US	high7.5	14.6% (97th)	Exploit	no fix	2017-08-08	2 versions
CVE-2017-11153US	critical9.8	12.2% (96th)	Exploit	no fix	2017-08-08	2 versions
CVE-2017-11154US	high7.2	8.63% (95th)	Exploit	no fix	2017-08-08	2 versions
CVE-2016-10329US	critical9.8	40.8% (99th)	—	no fix	2017-05-12	≤ 6.5.2-3225
CVE-2017-16772US	high8.8	3.15% (88th)	—	6.8.3-3463	2018-03-22	2 versions
CVE-2016-10331US	high7.5	2.17% (82nd)	—	no fix	2017-05-12	≤ 6.5.2-3225
CVE-2016-10322US	high8.8	1.94% (80th)	—	no fix	2017-04-10	≤ 6.3-2954
CVE-2021-29089US	critical9.8	1.93% (80th)	—	6.8.14-3500	2021-06-02	6.8 → 6.8.14-3500
CVE-2017-16769US	medium5.3	1.85% (79th)	—	no fix	2018-02-23	= 6.8.1-3458
CVE-2017-12079US	high7.5	1.85% (79th)	—	6.3-2970	2017-12-04	2 versions
CVE-2021-29092US	high8.8	1.75% (78th)	—	6.8.14-3500	2021-06-01	6.8 → 6.8.14-3500
CVE-2018-8926US	high8.8	1.71% (77th)	—	6.8.5-3471	2018-06-08	2 versions
CVE-2019-11821US	critical9.8	1.71% (77th)	—	6.3-2977	2019-06-30	2 versions
CVE-2021-29090US	high7.2	1.67% (77th)	—	6.8.14-3500	2021-06-02	6.8 → 6.8.14-3500
CVE-2017-11162US	medium6.5	1.61% (76th)	—	no fix	2017-09-08	2 versions
CVE-2017-12080US	medium5.3	1.44% (73rd)	—	6.3-2970	2017-12-04	2 versions
CVE-2017-12071US	medium6.5	1.37% (72nd)	—	no fix	2017-09-08	2 versions
CVE-2017-16771US	medium6.1	1.28% (70th)	—	6.3-2971	2018-03-22	2 versions
CVE-2019-11822US	medium6.5	1.27% (70th)	—	6.3-2977	2019-06-30	2 versions
CVE-2017-11161US	critical9.8	1.24% (69th)	—	no fix	2017-09-08	2 versions
CVE-2015-4656US	medium4.3	1.23% (69th)	—	no fix	2015-06-18	≤ 6.3-2944
CVE-2021-29091US	medium6.5	1.14% (67th)	—	6.8.14-3500	2021-06-02	6.8 → 6.8.14-3500
CVE-2017-12072US	medium5.4	1.01% (63rd)	—	6.8.0-3456	2017-12-20	< 6.8.0-3456
CVE-2022-22681US	high7.5	1.00% (63rd)	—	6.8.16-3506	2022-07-06	< 6.8.16-3506
CVE-2018-13282US	medium6.3	0.96% (61st)	—	6.3-2976	2018-10-31	2 versions
CVE-2015-9102US	medium5.4	0.89% (59th)	—	no fix	2017-06-30	≤ 6.3-2960
CVE-2017-9555US	medium5.4	0.79% (56th)	—	no fix	2017-08-24	≤ 6.6.3-3347
CVE-2018-8925US	high8.8	0.73% (54th)	—	6.8.5-3471	2018-06-08	2 versions
CVE-2016-10330US	high7.1	0.69% (53rd)	—	no fix	2017-05-12	≤ 6.5.2-3225
CVE-2016-10323US	high7.8	0.59% (48th)	—	6.3-2958	2017-04-10	< 6.3-2958
CVE-2017-9552US	high7.8	0.31% (24th)	—	no fix	2017-06-13	24 versions

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')6 CVEs
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')5 CVEs
CWE-200Exposure of Sensitive Information to an Unauthorized Actor4 CVEs
CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')4 CVEs
CWE-434Unrestricted Upload of File with Dangerous Type3 CVEs
CWE-287Improper Authentication2 CVEs
CWE-384Session Fixation2 CVEs
CWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')2 CVEs

sources (1)

Which sources assert this record, and when.

USNVD / CVE33 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan