CVE-2015-2851

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2015-05-30 · updated 2026-06-17
Weakness: CWE-264

Description

client_chown in the sync client in Synology Cloud Station 1.1-2291 through 3.1-3320 on OS X allows local users to change the ownership of arbitrary files, and consequently obtain root access, by specifying a filename.

Affected products

Synology Cloud Station: 1.1-2291, 2.0-2291, 2.0-2402, 2.1-2561, 2.1-2570, 2.1-2577 (+7)

References

http://www.kb.cert.org/vuls/id/551972
http://www.kb.cert.org/vuls/id/BLUU-9VBU45
http://www.securityfocus.com/bid/74826
http://www.kb.cert.org/vuls/id/551972
http://www.kb.cert.org/vuls/id/BLUU-9VBU45
http://www.securityfocus.com/bid/74826

Get alerted when CVE-2015-2851 or the next vulnerability affects your stack