3 ms·
If the device is vulnerable to a CSRF, then couldn't it be compromised simply by some browser on the LAN ending up on an unfortunate site that does some javascr
by 0x0 12y ago
If the device is vulnerable to a CSRF, then couldn't it be compromised simply by some browser on the LAN ending up on an unfortunate site that does some javascript hijinks to POST to likely, internal, IP addresses for a NAS? No open WAN ports needed.
Also, wasn't there a remote root exploit for samba4 patched just days ago?
- me1010 12y agohttp://www.wegotserved.com/2014/07/30/synology-patches-nas-security-vulnerability-improves-raid-stability/ http://www.wegotserved.com/2014/07/30/synology-patches-nas-s... However, there's really no reason to expose samba shares to the Internet. There are much better and more secure methods. As to the unfortunate victim, there's most likely no way anyone will be able to retrieve what has been locked by the remote attacker - except the remote attacker.