Read the docs
TI-2015-02516 Aliases CVE-2015-2851GHSA-32rj-qg36-98x6

client_chown in the sync client in Synology Cloud Station 1.1-2291 through 3.1-3320 on OS…

Priority LOW 31CWE-264Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Complete · Complete · Complete
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-264.

Summary

client_chown in the sync client in Synology Cloud Station 1.1-2291 through 3.1-3320 on OS X allows local users to change the ownership of arbitrary files, and consequently obtain root access, by specifying a filename.

Why it matters now

EPSS 0.0075 55th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 14

CPEVersionsRoleVendor
cpe:2.3:a:synology:cloud_station:1.1-2291:*:*:*:*:*:*:*1.1-2291VulnerableSynology
cpe:2.3:a:synology:cloud_station:2.0-2291:*:*:*:*:*:*:*2.0-2291VulnerableSynology
cpe:2.3:a:synology:cloud_station:2.0-2402:*:*:*:*:*:*:*2.0-2402VulnerableSynology
cpe:2.3:a:synology:cloud_station:2.1-2561:*:*:*:*:*:*:*2.1-2561VulnerableSynology
cpe:2.3:a:synology:cloud_station:2.1-2570:*:*:*:*:*:*:*2.1-2570VulnerableSynology
cpe:2.3:a:synology:cloud_station:2.1-2577:*:*:*:*:*:*:*2.1-2577VulnerableSynology
cpe:2.3:a:synology:cloud_station:3.0-3005:*:*:*:*:*:*:*3.0-3005VulnerableSynology
cpe:2.3:a:synology:cloud_station:3.0-3103:*:*:*:*:*:*:*3.0-3103VulnerableSynology
cpe:2.3:a:synology:cloud_station:3.0-3108:*:*:*:*:*:*:*3.0-3108VulnerableSynology
cpe:2.3:a:synology:cloud_station:3.0-3109:*:*:*:*:*:*:*3.0-3109VulnerableSynology
  • cpe:2.3:a:synology:cloud_station:1.1-2291:*:*:*:*:*:*:* Versions 1.1-2291 Vulnerable ·Synology
  • cpe:2.3:a:synology:cloud_station:2.0-2291:*:*:*:*:*:*:* Versions 2.0-2291 Vulnerable ·Synology
  • cpe:2.3:a:synology:cloud_station:2.0-2402:*:*:*:*:*:*:* Versions 2.0-2402 Vulnerable ·Synology
  • cpe:2.3:a:synology:cloud_station:2.1-2561:*:*:*:*:*:*:* Versions 2.1-2561 Vulnerable ·Synology
  • cpe:2.3:a:synology:cloud_station:2.1-2570:*:*:*:*:*:*:* Versions 2.1-2570 Vulnerable ·Synology
  • cpe:2.3:a:synology:cloud_station:2.1-2577:*:*:*:*:*:*:* Versions 2.1-2577 Vulnerable ·Synology
  • cpe:2.3:a:synology:cloud_station:3.0-3005:*:*:*:*:*:*:* Versions 3.0-3005 Vulnerable ·Synology
  • cpe:2.3:a:synology:cloud_station:3.0-3103:*:*:*:*:*:*:* Versions 3.0-3103 Vulnerable ·Synology
  • cpe:2.3:a:synology:cloud_station:3.0-3108:*:*:*:*:*:*:* Versions 3.0-3108 Vulnerable ·Synology
  • cpe:2.3:a:synology:cloud_station:3.0-3109:*:*:*:*:*:*:* Versions 3.0-3109 Vulnerable ·Synology
Show 4 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:synology:cloud_station:3.0-3111:*:*:*:*:*:*:*3.0-3111VulnerableSynology
cpe:2.3:a:synology:cloud_station:3.1-3317:*:*:*:*:*:*:*3.1-3317VulnerableSynology
cpe:2.3:a:synology:cloud_station:3.1-3320:*:*:*:*:*:*:*3.1-3320VulnerableSynology
cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*all versionsRunning onApple
  • cpe:2.3:a:synology:cloud_station:3.0-3111:*:*:*:*:*:*:* Versions 3.0-3111 Vulnerable ·Synology
  • cpe:2.3:a:synology:cloud_station:3.1-3317:*:*:*:*:*:*:* Versions 3.1-3317 Vulnerable ·Synology
  • cpe:2.3:a:synology:cloud_station:3.1-3320:*:*:*:*:*:*:* Versions 3.1-3320 Vulnerable ·Synology
  • cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:* Versions all versions Running on ·Apple

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2015-2851
  2. 2026-10-03 Alias added: GHSA-32rj-qg36-98x6

References

Advisory 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences