CVE-2010-3684

Severity: low (CVSS 2.1 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2010-09-29 · updated 2026-06-16
Weakness: CWE-255

Description

The FTP authentication module in Synology Disk Station 2.x logs passwords to the web application interface in cases of incorrect login attempts, which allows local users to obtain sensitive information by reading a log, a different vulnerability than CVE-2010-2453.

Affected products

Synology Dsm: 2.2-0942, 2.2-1041, 2.2-1042, 2.2-1045, 2.3-1139, 2.3-1141 (+3)

References

http://www.securityfocus.com/archive/1/513970/100/0/threaded
http://www.securityfocus.com/archive/1/513970/100/0/threaded

Get alerted when CVE-2010-3684 or the next vulnerability affects your stack