Summary
Ein Angreifer kann mehrere Schwachstellen in Synology DiskStation Manager ausnutzen, um Dateien zu manipulieren, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um einen SQL-Injection Angriff durchzuführen, um einen Cross-Site Scripting Angriff durchzuführen und um Sicherheitsvorkehrungen zu umgehen.
Product
DiskStation Manager (DSM) ist ein webbasiertes Betriebssystem für Synology NAS-Geräte.
Vulnerabilities 27
-
Critical 9.8CVE-2026-76954 Public exploit
An improper neutralization of special elements used in an SQL command vulnerability in the Auth API in Synology DiskSta…
-
High 8.8
An authorization bypass through user-controlled key vulnerability in the SSOAuth in Synology DiskStation Manager (DSM) …
-
High 8.8
An improper limitation of a pathname to a restricted directory vulnerability in the Sharing API in Synology DiskStation…
-
High 8.8
A missing critical step in authentication vulnerability in the Auth API in Synology DiskStation Manager (DSM) before 7.…
-
High 8.6
An authentication bypass using an alternate path or channel vulnerability in the rsync in Synology DiskStation Manager …
-
High 8.1
An authentication bypass using an alternate path or channel vulnerability in the OTP in Synology DiskStation Manager (D…
-
High 8.1
An improper link resolution before file access vulnerability in the thumb in Synology DiskStation Manager (DSM) before …
-
High 8.1
An improper neutralization of special elements used in an SQL command vulnerability in the User API in Synology DiskSta…
-
High 7.5
An access of uninitialized pointer vulnerability in the nfsd in Synology DiskStation Manager (DSM) before 7.3.2-86009-5…
-
High 7.2
An improper neutralization of special elements used in an OS command vulnerability in the VPN API in Synology DiskStati…
-
Medium 6.8
An improper neutralization of CRLF sequences vulnerability in the SNMP API in Synology DiskStation Manager (DSM) before…
-
Medium 6.5
A missing authentication for critical functionality vulnerability in the Webdav API in Synology DiskStation Manager (DS…
-
Medium 6.5
An external control of file name or path vulnerability in the Media Parser in Synology DiskStation Manager (DSM) before…
-
Medium 6.5
An insertion of sensitive information into sent data vulnerability in the API framework in Synology DiskStation Manager…
-
Medium 5.9
An improper certificate validation vulnerability in the Support Form in Synology DiskStation Manager (DSM) before 7.3.2…
-
Medium 5.4
An improper neutralization of input during web page generation vulnerability in the Audio Player in Synology DiskStatio…
-
Medium 5.4
A missing authorization vulnerability in the ACL API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4…
-
Medium 5.4
An improper neutralization of input during web page generation vulnerability in the DSMNotify in Synology DiskStation M…
-
Medium 5.4
An improper neutralization of input during web page generation vulnerability in the Notification API in Synology DiskSt…
-
Medium 5.3
An incorrect authorization vulnerability in the Security Advisor in Synology DiskStation Manager (DSM) before 7.3.2-860…
-
Medium 5.3
A reachable assertion vulnerability in the synoscgi in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.…
-
Medium 4.3
A missing authorization vulnerability in the Promotion API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 a…
-
Medium 4.3
An improper limitation of a pathname to a restricted directory vulnerability in the contentextract in Synology DiskStat…
-
Medium 4.3
A server-side request forgery vulnerability in the Credential API in Synology DiskStation Manager (DSM) before 7.3.2-86…
-
Medium 4.3
A missing authorization vulnerability in the SocketIo API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 an…
-
Medium 4.3
A missing authorization vulnerability in the TaskScheduler API in Synology DiskStation Manager (DSM) before 7.3.2-86009…
-
Medium 4.3
An external control of system or configuration setting vulnerability in the synomount in Synology DiskStation Manager (…
Revision history
-
#2
Referenz(en) aufgenommen: EUVD-2026-124192, EUVD-2026-124191, EUVD-2026-124190, EUVD-2026-124189, EUVD-2026-124188, EUVD-2026-124187, EUVD-2026-124186, EUVD-2026-124185, EUVD-2026-124184, EUVD-2026-124182, EUVD-2026-124181, EUVD-2026-124180, EUVD-2026-124200, EUVD-2026-124199, EUVD-2026-124198, EUVD-2026-124197, EUVD-2026-124196, EUVD-2026-124195, EUVD-2026-124194, EUVD-2026-124193, EUVD-2026-124183
-
#1
Initiale Fassung
References
-
Synology Security Adviosry vom 2026-11-09
https://www.synology.com/en-global/support/security/Synology_SA_26_19
-
Synology Security Adviosry vom 2026-11-09
https://www.synology.com/en-global/support/security/Synology_SA_26_18