CVE-2017-15887

CVE-2017-15887 is a critical vulnerability affecting Synology CardDAV Server versions prior to 6.0.7-0085. It stems from an improper restriction of excessive authentication attempts, specifically in the /principals endpoint, allowing remote attackers to conduct brute-force attacks to obtain user credentials. With a CVSS score of 9.8, this vulnerability is easily exploitable over the network with low attack complexity, potentially leading to complete compromise of confidentiality, integrity, and availability. While no active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion has been observed, its high severity warrants immediate patching.