{"vulnerability": "CVE-2017-15889", "sightings": [{"uuid": "368f0422-ac31-4a00-a318-65f9a768e036", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-15889", "type": "exploited", "source": "https://www.exploit-db.com/exploits/48514", "content": "", "creation_timestamp": "2020-05-25T00:00:00.000000Z"}, {"uuid": "81a4337f-73ba-4aad-9b7e-f6657e8072f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-15889", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:43.000000Z"}, {"uuid": "fc4a0c50-47e9-45d4-ac18-3c430766c94f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-15889", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:09:54.000000Z"}, {"uuid": "6462a39c-67a0-4c0c-be85-776938565600", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-15889", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/synology_dsm_smart_exec_auth.rb", "content": "", "creation_timestamp": "2020-05-22T15:17:38.000000Z"}, {"uuid": "3ddd3d0b-e177-4e7b-97f6-6034e036d63e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-15889", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/synology_dsm_smart_exec_auth.rb", "content": "{\"aliases\": [], \"arch\": \"python\", \"author\": [\"Nigusu Kassahun\", \"h00die\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a vulnerability found in Synology DiskStation Manager (DSM)\\n          versions < 5.2-5967-5, which allows the execution of arbitrary commands under root\\n          privileges after website authentication.\\n          The vulnerability is located in webman/modules/StorageManager/smart.cgi, which\\n          allows appending of a command to the device to be scanned.  However, the command\\n          with drive is limited to 30 characters.  A somewhat valid drive name is required,\\n          thus /dev/sd is used, even though it doesn't exist.  To circumvent the character\\n          restriction, a wget input file is staged in /a, and executed to download our payload\\n          to /b.  From there the payload is executed.  A wfsdelay is required to give time\\n          for the payload to download, and the execution of it to run.\", \"disclosure_date\": \"2017-11-08\", \"fullname\": \"exploit/linux/http/synology_dsm_smart_exec_auth\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:55:15 +0000\", \"name\": \"Synology DiskStation Manager smart.cgi Remote Command Execution\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"config-changes\", \"artifacts-on-disk\", \"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/http/synology_dsm_smart_exec_auth.rb\", \"platform\": \"Python\", \"post_auth\": true, \"rank\": 600, \"ref_name\": \"linux/http/synology_dsm_smart_exec_auth\", \"references\": [\"CVE-2017-15889\", \"EDB-43190\", \"URL-https://ssd-disclosure.com/ssd-advisory-synology-storagemanager-smart-cgi-remote-command-execution/\", \"URL-https://synology.com/en-global/security/advisory/Synology_SA_17_65_DSM\", \"ATT&CK-T1021\"], \"rport\": 5000, \"session_types\": false, \"targets\": [\"Automatic\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:48:57.633544Z"}]}