CVE-2018-8914

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-05-10 · updated 2026-06-17
Weakness: CWE-89

Description

SQL injection vulnerability in UPnP DMA in Synology Media Server before 1.7.6-2842 and before 1.4-2654 allows remote attackers to execute arbitrary SQL commands via the ObjectID parameter.

Affected products

Synology Media Server: from 1.4 before 1.4-2654; from 1.7 before 1.7.6-2842 — fixed in 1.4-2654, 1.7.6-2842

How to fix

Upgrade to a fixed version: Synology Media Server 1.4-2654, 1.7.6-2842. Check the vendor advisory for mitigations.

References

https://www.synology.com/en-global/support/security/Synology_SA_18_04
https://www.synology.com/en-global/support/security/Synology_SA_18_04

Get alerted when CVE-2018-8914 or the next vulnerability affects your stack