CVE-2018-13298

Severity: high (CVSS 8.1 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-04-01 · updated 2026-06-17
Weakness: CWE-300

Description

Channel accessible by non-endpoint vulnerability in privacy page in Synology Android Moments before 1.2.3-199 allows man-in-the-middle attackers to execute arbitrary code via unspecified vectors.

Affected products

Synology Photo Moments: before 1.2.3-199 — fixed in 1.2.3-199

How to fix

Upgrade to a fixed version: Synology Photo Moments 1.2.3-199. Check the vendor advisory for mitigations.

References

https://www.synology.com/security/advisory/Synology_SA_18_52
https://www.synology.com/security/advisory/Synology_SA_18_52

Get alerted when CVE-2018-13298 or the next vulnerability affects your stack