CVE-2017-11153

This is a weakness that lets an attacker send a “crafted data package” that the Photo Station software handles unsafely. Instead of treating it as harmless data, the software effectively gives the attacker administrator power—similar to tricking a lock to open itself—so they can read everything, change settings, and disrupt service.

This matters if your business runs Synology Photo Station on a network where someone could reach it, because the flaw can be used without any login and needs no user action. It’s only a risk if the target Photo Station version is older than 6.7.3-3432 or older than 6.3-2967, and the vulnerable service is reachable from where an attacker can send network messages. Your exposure is typically lower if Photo Station is not accessible from untrusted networks (for example, not reachable from the internet).

This should be treated as urgent because attackers can exploit it remotely without authentication to gain administrator control. Public exploits are available, so the risk is not hypothetical for exposed systems, and it aligns with an AMBER severity rating.

1. Confirm exposure (what to check)

• Identify the installed Synology Photo Station version.
• The system is affected if it is running a version prior to 6.7.3-3432 OR prior to 6.3-2967.
• Confirm whether Synology Photo Station is reachable from untrusted networks (for example, from the internet or other outside networks). Findings state it is reachable in default configuration.

2. Apply the fix (exact target)

• Upgrade using Synology’s remediation guidance for “Synology_SA_17_34_PhotoStation”.
• Your goal is to move to at least:
  • 6.7.3-3432 for the 6.7 branch, or
  • 6.3-2967 for the 6.3 branch.
• Use Synology’s advisory link provided in the materials to pick the correct upgrade package for your current branch.

3. Validate after upgrading

• Confirm Photo Station services start normally.
• Check that Photo Station continues to function for your users.
• If you have logs accessible, review recent attempts around the time of testing/upgrade for unusual requests.

4. If patching is delayed (temporary containment)

• Restrict network access to Photo Station as tightly as possible until the upgrade is complete (for example, limit access to only the internal network/VPN users who need it).
• Do not rely on “it’s rarely used”; the flaw requires no login and no user interaction.

5. Monitor

• Continue watching for unexpected network traffic to Photo Station and for any administrative/configuration changes right after upgrade windows.

Severity and impact: The findings describe unauthenticated remote compromise leading to full administrator privileges, including reading all data, modifying settings, and disrupting services.

Weakness type: CWE-502 (deserialization vulnerability). The flaw is in synophoto_csPhotoMisc.php and is triggered by processing unsafe crafted serialized data.

Attack vector and preconditions: Network-based, no authentication required, no user interaction required, and described as reachable in default configuration. Affected only when Synology Photo Station is running prior to 6.7.3-3432 or prior to 6.3-2967.

Exploitation status: A public exploit is available. No KEV listing was provided.

EPSS note: A predicted likelihood was provided, but public guidance here does not treat it as deciding the urgency because exploit availability and the AMBER verdict take precedence.

What KEV means here: KEV is the CISA Known Exploited Vulnerabilities catalog; this CVE was not listed in the provided KEV findings.