TI-2021-09099 Aliases CVE-2021-27648 GHSA-55vq-f28f-xgcc

Externally controlled reference to a resource in another sphere in quarantine…

MEDIUM 44CWE-610Published 2021-04-28 · Updated 2024-09-16

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Externally controlled reference to a resource in another sphere in quarantine functionality in Synology Antivirus Essential before 1.4.8-2801 allows remote authenticated users to obtain privilege via unspecified vectors.

Why it matters now

EPSS 0.02843 86th percentileScored 2026-11-07

Fix Fixed Synology Antivirus Essential (Synology): 1.4.8-2801

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Synology	Synology Antivirus Essential	before 1.4.8-2801	1.4.8-2801	Patch available	CNA

Synology Antivirus Essential VendorSynology Affected before 1.4.8-2801 Fixed in 1.4.8-2801 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:synology:antivirus_essential::::::::	before 1.4.8-2801	Vulnerable	Synology

cpe:2.3:a:synology:antivirus_essential:*:*:*:*:*:*:*:* Versions before 1.4.8-2801 Vulnerable ·Synology

Remediation

Fix · CNA Synology Antivirus Essential (Synology) Fixed in 1.4.8-2801

Timeline

2026-10-02 Threatist record created from CVE-2021-27648
2026-10-03 Alias added: GHSA-55vq-f28f-xgcc

References

Advisory 1

https://www.synology.com/security/advisory/Synology_SA_21_15

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences