Synology Diskstation Manager vulnerabilities

96 known vulnerabilities affecting synology/diskstation_manager.

Total CVEs

CISA KEV

actively exploited

Public exploits

Exploited in wild

Severity breakdown

CRITICAL18HIGH47MEDIUM29LOW2

Vulnerabilities

Page 5 of 5

CVE-2018-7185HIGHCVSS 7.5≥ 5.2, < 6.1.6-152662018-03-06

CVE-2018-7185 [HIGH] CVE-2018-7185: The protocol engine in ntp 4.2.6 before 4.2.8p11 allows a remote attackers to cause a denial of serv The protocol engine in ntp 4.2.6 before 4.2.8p11 allows a remote attackers to cause a denial of service (disruption) by continually sending a packet with a zero-origin timestamp and source IP address of the "other side" of an interleaved association causing the victim ntpd to reset its association.

nvd

CVE-2018-7170MEDIUMCVSS 5.3≥ 5.2, < 6.1.6-152662018-03-06

CVE-2018-7170 [MEDIUM] CVE-2018-7170: ntpd in ntp 4.2.x before 4.2.8p7 and 4.3.x before 4.3.92 allows authenticated users that know the pr ntpd in ntp 4.2.x before 4.2.8p7 and 4.3.x before 4.3.92 allows authenticated users that know the private symmetric key to create arbitrarily-many ephemeral associations in order to win the clock selection of ntpd and modify a victim's clock via a Sybil attack. This issue exists because of an incomplete fix for CVE-2016-1549.

nvd

CVE-2017-5753MEDIUMCVSS 5.6PoC≥ 5.2, < 6.2.2-249222018-01-04

CVE-2017-5753 [MEDIUM] CWE-203 CVE-2017-5753: Systems with microprocessors utilizing speculative execution and branch prediction may allow unautho Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis.

nvd

CVE-2017-16766MEDIUMCVSS 6.5≥ 6.0.0, < 6.0.3-8754-6≥ 6.1.0, < 6.1.4-15217+2 more2017-12-22

CVE-2017-16766 [MEDIUM] CWE-284 CVE-2017-16766: An improper access control vulnerability in synodsmnotify in Synology DiskStation Manager (DSM) befo An improper access control vulnerability in synodsmnotify in Synology DiskStation Manager (DSM) before 6.1.4-15217 and before 6.0.3-8754-6 allows local users to inject arbitrary web script or HTML via the -fn option.

cvelistv5nvd

CVE-2017-15894MEDIUMCVSS 6.5≥ 5.2, < 5.2-5967-6≥ 6.0, < 6.0.3-8754-32017-12-08

CVE-2017-15894 [MEDIUM] CWE-22 CVE-2017-15894: Directory traversal vulnerability in the SYNO.FileStation.Extract in Synology DiskStation Manager (D Directory traversal vulnerability in the SYNO.FileStation.Extract in Synology DiskStation Manager (DSM) 6.0.x before 6.0.3-8754-3 and before 5.2-5967-6 allows remote authenticated users to write arbitrary files via the dest_folder_path parameter.

nvd

CVE-2017-15889HIGHCVSS 8.8PoCfixed in 5.2-5967-5vbefore 5.2-5967-52017-12-04

CVE-2017-15889 [HIGH] CWE-77 CVE-2017-15889: Command injection vulnerability in smart.cgi in Synology DiskStation Manager (DSM) before 5.2-5967-5 Command injection vulnerability in smart.cgi in Synology DiskStation Manager (DSM) before 5.2-5967-5 allows remote authenticated users to execute arbitrary commands via disk field.

cvelistv5nvd

CVE-2017-14491CRITICALCVSS 9.8PoCv5.2v6.0+1 more2017-10-04

CVE-2017-14491 [CRITICAL] CWE-787 CVE-2017-14491: Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of servi Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response.

nvd

CVE-2017-12076MEDIUMCVSS 4.9≤ 6.1v6.1.12017-08-28

CVE-2017-12076 [MEDIUM] CWE-400 CVE-2017-12076: Uncontrolled Resource Consumption vulnerability in SYNO.Core.PortForwarding.Rules in Synology DiskSt Uncontrolled Resource Consumption vulnerability in SYNO.Core.PortForwarding.Rules in Synology DiskStation (DSM) before 6.1.1-15088 allows remote authenticated attacker to exhaust the memory resources of the machine, causing a denial of service attack.

nvd

CVE-2017-9553HIGHCVSS 7.5≤ 6.1.1-15101-42017-07-24

CVE-2017-9553 [HIGH] CVE-2017-9553: A design flaw in SYNO.API.Encryption in Synology DiskStation Manager (DSM) before 6.1.3-15152 allows A design flaw in SYNO.API.Encryption in Synology DiskStation Manager (DSM) before 6.1.3-15152 allows remote attackers to bypass the encryption protection mechanism via the crafted version parameter.

nvd

CVE-2017-9554MEDIUMCVSS 5.3ExploitedPoC≤ 6.1.1-15101-42017-07-24

CVE-2017-9554 [MEDIUM] CWE-200 CVE-2017-9554: An information exposure vulnerability in forget_passwd.cgi in Synology DiskStation Manager (DSM) bef An information exposure vulnerability in forget_passwd.cgi in Synology DiskStation Manager (DSM) before 6.1.3-15152 allows remote attackers to enumerate valid usernames via unspecified vectors.

nvd

CVE-2015-4655MEDIUMCVSS 4.3≤ 5.2-55652015-06-18

CVE-2015-4655 [MEDIUM] CWE-79 CVE-2015-4655: Cross-site scripting (XSS) vulnerability in Synology DiskStation Manager (DSM) before 5.2-5565 Updat Cross-site scripting (XSS) vulnerability in Synology DiskStation Manager (DSM) before 5.2-5565 Update 1 allows remote attackers to inject arbitrary web script or HTML via the "compound" parameter to entry.cgi.

nvd

CVE-2015-2809MEDIUMCVSS 5.0≤ 3.02015-04-01

CVE-2015-2809 [MEDIUM] CWE-200 CVE-2015-2809: The Multicast DNS (mDNS) responder in Synology DiskStation Manager (DSM) before 3.1 inadvertently re The Multicast DNS (mDNS) responder in Synology DiskStation Manager (DSM) before 3.1 inadvertently responds to unicast queries with source addresses that are not link-local, which allows remote attackers to cause a denial of service (traffic amplification) or obtain potentially sensitive information via port-5353 UDP packets to the Avahi component.

nvd

CVE-2012-1556MEDIUMCVSS 4.3PoCv3.2-19552014-09-12

CVE-2012-1556 [MEDIUM] CWE-79 CVE-2012-1556: Cross-site scripting (XSS) vulnerability in Synology Photo Station 5 for DiskStation Manager (DSM) 3 Cross-site scripting (XSS) vulnerability in Synology Photo Station 5 for DiskStation Manager (DSM) 3.2-1955 allows remote attackers to inject arbitrary web script or HTML via the name parameter to photo/photo_one.php.

nvd

CVE-2014-2264HIGHCVSS 7.8v4.3-38102014-03-02

CVE-2014-2264 [HIGH] CWE-200 CVE-2014-2264: The OpenVPN module in Synology DiskStation Manager (DSM) 4.3-3810 update 1 has a hardcoded root pass The OpenVPN module in Synology DiskStation Manager (DSM) 4.3-3810 update 1 has a hardcoded root password of synopass, which makes it easier for remote attackers to obtain access via a VPN session.

nvd

CVE-2013-6955CRITICALCVSS 10.0PoCv4.0v4.2+2 more2014-01-09

CVE-2013-6955 [CRITICAL] CWE-264 CVE-2013-6955: webman/imageSelector.cgi in Synology DiskStation Manager (DSM) 4.0 before 4.0-2259, 4.2 before 4.2-3 webman/imageSelector.cgi in Synology DiskStation Manager (DSM) 4.0 before 4.0-2259, 4.2 before 4.2-3243, and 4.3 before 4.3-3810 Update 1 allows remote attackers to append data to arbitrary files, and consequently execute arbitrary code, via a pathname in the SLICEUPLOAD X-TMP-FILE HTTP header.

nvd

CVE-2013-6987HIGHCVSS 7.5PoCv4.3-38102013-12-31

CVE-2013-6987 [HIGH] CWE-22 CVE-2013-6987: Multiple directory traversal vulnerabilities in the FileBrowser components in Synology DiskStation M Multiple directory traversal vulnerabilities in the FileBrowser components in Synology DiskStation Manager (DSM) before 4.3-3810 Update 3 allow remote attackers to read, write, and delete arbitrary files via a .. (dot dot) in the (1) path parameter to file_delete.cgi or (2) folder_path parameter to file_share.cgi in webapi/FileStation/; (3) dlink paramet

nvd

← Previous5 / 5