description: Command injection vulnerability in login.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to execute arbitrary code via shell metacharacters in the crafted 'X-Forwarded-For' header.
problem types: Arbitrary Code Execution (CWE-77)
affected:
{
product: Synology Photo Station
vendor: Synology
versions:
status: affected, version: All versions prior to version 6.5.3-3226
}