CVE-2017-11153

This is a weakness that lets an attacker send a “crafted data package” that the Photo Station software handles unsafely. Instead of treating it as harmless data, the software effectively gives the attacker administrator power—similar to tricking a lock to open itself—so they can read everything, change settings, and disrupt service.

This matters if your business runs Synology Photo Station on a network where someone could reach it, because the flaw can be used without any login and needs no user action. It’s only a risk if the target Photo Station version is older than 6.7.3-3432 or older than 6.3-2967, and the vulnerable service is reachable from where an attacker can send network messages. Your exposure is typically lower if Photo Station is not accessible from untrusted networks (for example, not reachable from the internet).

This should be treated as urgent because attackers can exploit it remotely without authentication to gain administrator control. Public exploits are available, so the risk is not hypothetical for exposed systems, and it aligns with an AMBER severity rating.