Back to Database
Status published
Critical
CVE-2021-43928
Improper neutralization of special elements used in an OS command...
Vulnerability Description
Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in mail sending and receiving component in Synology Mail Station before 20211105-10315 allows remote authenticated users to execute arbitrary commands via unspecified vectors.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-43928
Credits & Attribution
No credits recorded in the NVD database.
More from Synology
View All →CVE-2025-8074
Origin validation error vulnerability in BeeDrive in Synology BeeDrive for...
Medium
5.6
CVE-2025-66593
An origin validation error vulnerability in Synology Assistant before 7.0.6-50085...
Medium
6.1
CVE-2025-66592
An origin validation error vulnerability in Synology Active Backup for...
Medium
6.1
CVE-2025-54160
Improper limitation of a pathname to a restricted directory ('Path...
High
7.8
CVE-2025-54159
Missing authorization vulnerability in BeeDrive in Synology BeeDrive for desktop...
High
7.5
Affected Vendor
Synology
View all reports →Affected Software
Mail Station
Vulnerable Versions:
unspecified
Timeline
Official Publish:
February 7th, 2022
Last Modified:
September 17th, 2024
Added to House:
July 21st, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H