Summary
Ein Angreifer kann mehrere Schwachstellen in Synology DiskStation Manager ausnutzen, um Dateien zu manipulieren, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um einen Cross-Site Scripting Angriff durchzuführen und um einen SQL-Injection Angriff durchzuführen.
Product
DiskStation Manager (DSM) ist ein webbasiertes Betriebssystem für Synology NAS-Geräte.
Vulnerabilities 8
-
Critical 9.8
An insufficient entropy vulnerability in login logic in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2…
-
Critical 9.8CVE-2026-13684 Public exploit
An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation Manager (DSM) before 7.2.1-690…
-
High 8.8
An incorrect permission assignment for critical resource vulnerability in LDAP API in Synology DiskStation Manager (DSM…
-
High 8.1
An external control of file name or path vulnerability in Upload API in Synology DiskStation Manager (DSM) before 7.2.1…
-
Medium 5.3
An improper encoding or escaping of output vulnerability in Auth API in Synology DiskStation Manager (DSM) before 7.2.1…
-
Medium 4.8
An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Theme API in S…
-
Low 3.5
An improper neutralization of CRLF sequences ('CRLF Injection') vulnerability in Sharing API in Synology DiskStation Ma…
-
Low 2.7
An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in EventScheduler…
Revision history
-
#1
Initiale Fassung
References
-
Synology Security Advisory vom 2026-09-17
https://www.synology.com/en-global/support/security/Synology_SA_26_13