Synology Diskstation Manager vulnerabilities
116 known vulnerabilities affecting synology/diskstation_manager.
Total CVEs
116
CISA KEV
1
actively exploited
Public exploits
11
Exploited in wild
4
Severity breakdown
CRITICAL21HIGH51MEDIUM39LOW5
Vulnerabilities
Page 6 of 6
CVE-2026-40537P4MEDIUMCVSS 4.3≥ 7.3, < 7.3.2-86009-2≥ 7.2.2, < 7.2.2-72806-7+1 more2026-09-18
CVE-2026-40537 [MEDIUM] CWE-918 CVE-2026-40537: A server-side request forgery (SSRF) vulnerability in PersonMail API in Synology DiskStation Manager
A server-side request forgery (SSRF) vulnerability in PersonMail API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain non-sensitive information.
nvd
CVE-2018-8917P4MEDIUMCVSS 5.4fixed in 6.1.6-15266≥ unspecified, < 6.1.6-152662018-12-24
CVE-2018-8917 [MEDIUM] CWE-79 CVE-2018-8917: Cross-site scripting (XSS) vulnerability in info.cgi in Synology DiskStation Manager (DSM) before 6.
Cross-site scripting (XSS) vulnerability in info.cgi in Synology DiskStation Manager (DSM) before 6.1.6-15266 allows remote attackers to inject arbitrary web script or HTML via the host parameter.
nvd
CVE-2017-16774P4MEDIUMCVSS 5.4≥ 5.2, < 6.1.4-15217-3≥ unspecified, < 6.1.4-15217-32019-04-01
CVE-2017-16774 [MEDIUM] CWE-79 CVE-2017-16774: Cross-site scripting (XSS) vulnerability in SYNO.Core.PersonalNotification.Event in Synology DiskSta
Cross-site scripting (XSS) vulnerability in SYNO.Core.PersonalNotification.Event in Synology DiskStation Manager (DSM) before 6.1.4-15217-3 allows remote authenticated users to inject arbitrary web script or HTML via the package parameter.
nvd
CVE-2018-13293P4MEDIUMCVSS 5.4≥ 5.2, < 6.2.1-23824≥ unspecified, < 6.2.1-238242019-04-01
CVE-2018-13293 [MEDIUM] CWE-79 CVE-2018-13293: Cross-site scripting (XSS) vulnerability in Control Panel SSO Settings in Synology DiskStation Manag
Cross-site scripting (XSS) vulnerability in Control Panel SSO Settings in Synology DiskStation Manager (DSM) before 6.2.1-23824 allows remote authenticated users to inject arbitrary web script or HTML via the URL parameter.
nvd
CVE-2021-33182P4MEDIUMCVSS 4.3fixed in 6.2.4-255532021-06-01
CVE-2021-33182 [MEDIUM] CWE-22 CVE-2021-33182: Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in PDF
Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in PDF Viewer component in Synology DiskStation Manager (DSM) before 6.2.4-25553 allows remote authenticated users to read limited files via unspecified vectors.
nvd
CVE-2022-27622P4MEDIUMCVSS 4.3fixed in 7.1-42661≥ unspecified, < 7.1-426612022-10-25
CVE-2022-27622 [MEDIUM] CWE-918 CVE-2022-27622: Server-Side Request Forgery (SSRF) vulnerability in Package Center functionality in Synology DiskSta
Server-Side Request Forgery (SSRF) vulnerability in Package Center functionality in Synology DiskStation Manager (DSM) before 7.1-42661 allows remote authenticated users to access intranet resources via unspecified vectors.
nvd
CVE-2017-12076P4MEDIUMCVSS 4.9≤ 6.1v6.1.12017-08-28
CVE-2017-12076 [MEDIUM] CWE-400 CVE-2017-12076: Uncontrolled Resource Consumption vulnerability in SYNO.Core.PortForwarding.Rules in Synology DiskSt
Uncontrolled Resource Consumption vulnerability in SYNO.Core.PortForwarding.Rules in Synology DiskStation (DSM) before 6.1.1-15088 allows remote authenticated attacker to exhaust the memory resources of the machine, causing a denial of service attack.
nvd
CVE-2026-13623P4MEDIUMCVSS 4.8≥ 7.4, < 7.4-90075≥ 7.3.2, < 7.3.2-86009-4+2 more2026-09-18
CVE-2026-13623 [MEDIUM] CWE-79 CVE-2026-13623: An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerabilit
An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Theme API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users with administrator privileges to read or write limited files.
nvd
CVE-2026-40538P4LOWCVSS 3.7≥ 7.3.2, < 7.3.2-86009-2≥ 7.2.2, < 7.2.2-72806-7+1 more2026-09-18
CVE-2026-40538 [LOW] CWE-307 CVE-2026-40538: An improper restriction of excessive authentication attempts vulnerability in Auto block in Synology
An improper restriction of excessive authentication attempts vulnerability in Auto block in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote attackers to read limited files via brute-force attacks.
nvd
CVE-2026-40531P4MEDIUMCVSS 4.3≥ 7.3, < 7.3.2-86009-2≥ 7.2.2, < 7.2.2-72806-7+1 more2026-09-18
CVE-2026-40531 [MEDIUM] CWE-190 CVE-2026-40531: An integer overflow or wraparound vulnerability in File Operation in Synology DiskStation Manager (D
An integer overflow or wraparound vulnerability in File Operation in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to conduct limited denial-of-service attacks.
nvd
CVE-2026-13666P4LOWCVSS 3.5≥ 7.4, < 7.4-90075≥ 7.3.2, < 7.3.2-86009-4+2 more2026-09-18
CVE-2026-13666 [LOW] CWE-93 CVE-2026-13666: An improper neutralization of CRLF sequences ('CRLF Injection') vulnerability in Sharing API in Syno
An improper neutralization of CRLF sequences ('CRLF Injection') vulnerability in Sharing API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users to write limited files when a victim clicks a sharing URL.
nvd
CVE-2015-4655P4MEDIUMCVSS 4.3≤ 5.2-55652015-06-18
CVE-2015-4655 [MEDIUM] CWE-79 CVE-2015-4655: Cross-site scripting (XSS) vulnerability in Synology DiskStation Manager (DSM) before 5.2-5565 Updat
Cross-site scripting (XSS) vulnerability in Synology DiskStation Manager (DSM) before 5.2-5565 Update 1 allows remote attackers to inject arbitrary web script or HTML via the "compound" parameter to entry.cgi.
nvd
CVE-2018-13291P4MEDIUMCVSS 4.3≥ 5.2, < 6.2.1-23824≥ unspecified, < 6.2.1-238242019-04-01
CVE-2018-13291 [MEDIUM] CWE-200 CVE-2018-13291: Information exposure vulnerability in /usr/syno/etc/mount.conf in Synology DiskStation Manager (DSM)
Information exposure vulnerability in /usr/syno/etc/mount.conf in Synology DiskStation Manager (DSM) before 6.2.1-23824 allows remote authenticated users to obtain sensitive information via the world readable configuration.
nvd
CVE-2026-13683P4LOWCVSS 2.7≥ 7.4, < 7.4-90075≥ 7.3.2, < 7.3.2-86009-4+2 more2026-09-18
CVE-2026-13683 [LOW] CWE-89 CVE-2026-13683: An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerabilit
An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in EventScheduler API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users with administrator privileges to obtain non-sensitive information.
nvd
CVE-2020-27650P4LOWCVSS 3.7≥ 6.2, < 6.2.3-25426-2≥ unspecified, < 6.2.3-25426-22020-10-29
CVE-2020-27650 [LOW] CWE-614 CVE-2020-27650: Synology DiskStation Manager (DSM) before 6.2.3-25426-2 does not set the Secure flag for the session
Synology DiskStation Manager (DSM) before 6.2.3-25426-2 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session.
nvd
CVE-2020-27656P4LOWCVSS 3.7≥ 6.2, < 6.2.3-25426-2≥ unspecified, < 6.2.3-25426-22020-10-29
CVE-2020-27656 [LOW] CWE-319 CVE-2020-27656: Cleartext transmission of sensitive information vulnerability in DDNS in Synology DiskStation Manage
Cleartext transmission of sensitive information vulnerability in DDNS in Synology DiskStation Manager (DSM) before 6.2.3-25426-2 allows man-in-the-middle attackers to eavesdrop authentication information of DNSExit via unspecified vectors.
nvd
← Previous6 / 6