CVE-2021-29083

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

Improper neutralization of special elements used in an OS command in SYNO.Core.Network.PPPoE in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote authenticated users to execute arbitrary code via realname parameter.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
Synology	Synology DiskStation Manager (DSM)	>= unspecified, < 6.2.3-25426-3

References

https://www.synology.com/security/advisory/Synology_SA_20_26Vendor Advisory
https://www.synology.com/security/advisory/Synology_SA_20_26Vendor Advisory

Timeline

Published: Apr 1, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-290847.5Improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in Security Advisor report CVE-2021-290857.5Improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in file sharing management CVE-2021-290867.5Exposure of sensitive information to an unauthorized actor vulnerability in webapi component in Synology DiskStation Manager (DSM) before 6.CVE-2021-290877.5Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology DiskStation Man CVE-2021-290887.8Improper limitation of a pathname to a restricted directory ('Path Traversal') in cgi component in Synology DiskStation Manager (DSM) before CVE-2021-290899.8Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in thumbnail component in Synology Photo CVE-2021-290907.2Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in PHP component in Synology Photo Statio CVE-2021-290916.5Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in file management component in Synology Photo CVE-2021-290928.8Unrestricted upload of file with dangerous type vulnerability in file management component in Synology Photo Station before 6.8.14-3500 allo CVE-2021-290936.8A use-after-free vulnerability when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated atta CVE-2021-290946.8Multiple buffer overflow vulnerabilities when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenti CVE-2021-290956.8Multiple uninitialized pointer vulnerabilities when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an au