CVE-2021-43928

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in mail sending and receiving component in Synology Mail Station before 20211105-10315 allows remote authenticated users to execute arbitrary commands via unspecified vectors.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
Synology	Mail Station	>= unspecified, < 20211105-10315

References

https://www.synology.com/security/advisory/Synology_SA_21_28Vendor Advisory
https://www.synology.com/security/advisory/Synology_SA_21_28Vendor Advisory

Timeline

Published: Feb 7, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-439295.4Improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in work flow management in CVE-2021-43934.3The eCommerce Product Catalog Plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and i CVE-2021-439304.9Elcomplus SmartPTT is vulnerable as the backup and restore system does not adequately validate download requests, enabling malicious users t CVE-2021-439319.8The authentication algorithm of the WebHMI portal is sound, but the implemented mechanism can be bypassed as the result of a separate weakne CVE-2021-439326.1Elcomplus SmartPTT is vulnerable when an attacker injects JavaScript code into a specific parameter that can executed upon accessing the das CVE-2021-439335.9The affected product is vulnerable to a network-based attack by threat actors sending unimpeded requests to the receiving server, which coul CVE-2021-439349.8Elcomplus SmartPTT is vulnerable as the backup and restore system does not adequately validate upload requests, enabling a malicious user to CVE-2021-439359.8The impacted products, when configured to use SSO, are affected by an improper authentication vulnerability. This vulnerability allows the a CVE-2021-439369.8The software allows the attacker to upload or transfer files of dangerous types to the WebHMI portal, that may be automatically processed wi CVE-2021-439378.8Elcomplus SmartPTT SCADA Server web application does not, or cannot, sufficiently verify whether a well-formed, valid, consistent request wa CVE-2021-439389.8Elcomplus SmartPTT SCADA Server is vulnerable to an unauthenticated user can request various files from the server without any authenticatio CVE-2021-439398.8Elcomplus SmartPTT is vulnerable when a low-authenticated user can access higher level administration authorization by issuing requests dire