{"id":"CVE-2017-9554","aliases":["EUVD-2017-18485","GHSA-999r-3mg2-g4rj"],"status":"published","title":"An information exposure vulnerability in forget_passwd.cgi in Synology DiskStation Manager (DSM)...","description":"An information exposure vulnerability in forget_passwd.cgi in Synology DiskStation Manager (DSM) before 6.1.3-15152 allows remote attackers to enumerate valid usernames via unspecified vectors.","severity":{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.76716,"percentile":0.99549,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-200"],"published":"2017-07-24T20:00:00Z","modified":"2026-06-17T01:28:21Z","exploits":[{"source":"exploitdb","id":"EDB-43455","title":"Synology DiskStation Manager (DSM) \u003c 6.1.3-15152 - 'forget_passwd.cgi' User Enumeration","type":"webapps","platform":"cgi","date":"2018-01-08","url":"https://www.exploit-db.com/exploits/43455"},{"source":"metasploit","id":"auxiliary/scanner/http/synology_forget_passwd_user_enum","title":"Synology Forget Password User Enumeration Scanner","type":"auxiliary","date":"2011-01-05","verified":true,"url":"https://www.rapid7.com/db/modules/auxiliary/scanner/http/synology_forget_passwd_user_enum"},{"source":"pocgithub","id":"Ez0-yf/CVE-2017-9554-Exploit-Tool","title":"Ez0-yf/CVE-2017-9554-Exploit-Tool","date":"2021-06-08","url":"https://github.com/Ez0-yf/CVE-2017-9554-Exploit-Tool"},{"source":"pocgithub","id":"rfcl/Synology-DiskStation-User-Enumeration-CVE-2017-9554-","title":"rfcl/Synology-DiskStation-User-Enumeration-CVE-2017-9554-","date":"2018-08-28","url":"https://github.com/rfcl/Synology-DiskStation-User-Enumeration-CVE-2017-9554-"}],"products":[{"vendor":"synology","product":"diskstation_manager"}],"references":[{"url":"https://www.exploit-db.com/exploits/43455/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"]},{"url":"https://www.synology.com/en-global/support/security/Synology_SA_17_29_DSM","tags":["x_refsource_CONFIRM","x_transferred","Mitigation","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-9554"},{"url":"https://www.exploit-db.com/exploits/43455"},{"url":"https://github.com/advisories/GHSA-999r-3mg2-g4rj"}],"sources":{"cve":[{"id":"CVE-2017-9554","description":"An information exposure vulnerability in forget_passwd.cgi in Synology DiskStation Manager (DSM) before 6.1.3-15152 allows remote attackers to enumerate valid usernames via unspecified vectors.","status":"published","published":"2017-07-24T20:00:00Z","modified":"2024-08-05T17:11:02.166Z","updated_at":"2026-11-02T14:33:13.606903Z"}],"euvd":[{"id":"EUVD-2017-18485","description":"An information exposure vulnerability in forget_passwd.cgi in Synology DiskStation Manager (DSM) before 6.1.3-15152 allows remote attackers to enumerate valid usernames via unspecified vectors.","status":"published","published":"2017-07-24T20:00:00Z","modified":"2024-08-05T17:11:02Z","updated_at":"2026-11-03T02:23:27.678389Z"}],"ghsa":[{"id":"GHSA-999r-3mg2-g4rj","title":"An information exposure vulnerability in forget_passwd.cgi in Synology DiskStation Manager (DSM)...","description":"An information exposure vulnerability in forget_passwd.cgi in Synology DiskStation Manager (DSM) before 6.1.3-15152 allows remote attackers to enumerate valid usernames via unspecified vectors.","status":"published","published":"2022-05-14T03:50:44Z","modified":"2025-01-14T21:32:42Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:59:31.794566Z"}],"nvd":[{"id":"CVE-2017-9554","description":"An information exposure vulnerability in forget_passwd.cgi in Synology DiskStation Manager (DSM) before 6.1.3-15152 allows remote attackers to enumerate valid usernames via unspecified vectors.","status":"published","published":"2017-07-24T20:29:00.263Z","modified":"2026-06-17T01:28:21.277Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:03:54.862898Z"}]}}