CVE-2018-13298
CVE-2018-13298 is a medium-severity vulnerability in Synology Moments with a CVSS 3.x base score of 4.2. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-300.
Key facts
- Severity: Medium (CVSS 3.x base score 4.2)
- CVSS v2: 6.8
- EPSS exploit prediction: 1% (57th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-300
- Affected product: Synology Moments
- Published:
- Last modified:
Description
Channel accessible by non-endpoint vulnerability in privacy page in Synology Android Moments before 1.2.3-199 allows man-in-the-middle attackers to execute arbitrary code via unspecified vectors.
Frequently asked questions
- What is CVE-2018-13298?
- Channel accessible by non-endpoint vulnerability in privacy page in Synology Android Moments before 1.2.3-199 allows man-in-the-middle attackers to execute arbitrary code via unspecified vectors.
- How severe is CVE-2018-13298?
- CVE-2018-13298 has a CVSS 3.x base score of 4.2, rated medium severity. It is exploitable over network with high attack complexity, requires no privileges and user interaction. Impact on confidentiality is low, integrity low, and availability none.
- Is CVE-2018-13298 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (57th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2018-13298?
- CVE-2018-13298 affects Synology Moments. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2018-13298?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2018-13298 published?
- CVE-2018-13298 was published on 2019-04-01 and last updated on 2026-06-17.
References
Affected products (1)
- cpe:2.3:a:synology:moments:*:*:*:*:*:android:*:*
More vulnerabilities in Synology Moments
- CVE-2019-11826 — High (CVSS 8.0): Relative path traversal vulnerability in SYNO.PhotoTeam.Upload.Item in Synology Moments before 1.3.0-0691 allows remote…
All CVEs affecting Synology Moments →
Other CWE-300 vulnerabilities
- CVE-2023-31004 — High (CVSS 8.3): IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security…
- CVE-2024-31206 — High (CVSS 8.2): dectalk-tts is a Node package to interact with the aeiou Dectalk web API. In `[email protected]`, network requests to…
- CVE-2025-31214 — High (CVSS 8.1): This issue was addressed through improved state management. This issue is fixed in iOS 18.5 and iPadOS 18.5. An…
- CVE-2024-36553 — High (CVSS 8.1): Forever KidsWatch Call Me KW-50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h is vulnerable to MITM attack.
- CVE-2021-21953 — High (CVSS 8.1): An authentication bypass vulnerability exists in the process_msg() function of the home_security binary of Anker Eufy…
- CVE-2021-41033 — High (CVSS 8.1): In all released versions of Eclipse Equinox, at least until version 4.21 (September 2021), installation can be…