Synology Storage Manager CVE-2026-2237

The attacker must have local access to the Synology NAS device with read permissions on web server logs, browser history files, or another locally accessible artifact where GET request URLs are stored. CVSS PR:N with AV:L indicates local presence without elevated system privileges may suffice - for example, a restricted shell account with read access to log directories. The vulnerability is specifically tied to use of the volume encryption feature within Storage Manager; if volume encryption has never been configured or accessed via the DSM web interface, no sensitive query strings may have been generated or logged. Limiting factors include: requirement for physical or remote local access, dependency on the volume encryption feature having been actively used through the web UI, non-automatable exploitation per SSVC, and complete absence of network-level attack surface.

The CVSS base score of 6.2 (Medium) with vector AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N reflects a locally exploitable vulnerability requiring no privileges and low complexity, but constrained entirely to local access, which sharply limits its reach compared to network-exploitable flaws. The High confidentiality impact is significant if volume encryption credentials are exposed, as this could allow an attacker to decrypt otherwise protected storage volumes. However, real-world risk signals are consistently subdued: EPSS is 0.01% at the 1st percentile, SSVC rates exploitation as none and technical impact as only partial, CISA KEV does not list this CVE, and no proof-of-concept code has been identified. The SSVC 'Automatable: no' designation aligns with the local-only, artifact-dependent attack surface. This is a genuine security concern in multi-user NAS environments where local account access is shared, but prioritization behind network-exploitable or KEV-listed vulnerabilities is appropriate. The C:H rating may be generous if sensitive query strings are generated only during specific encryption setup operations rather than on every volume access.

A local attacker with filesystem read access on the Synology NAS - such as a restricted user account or a compromised service - reads DSM web server access logs or inspects browser history left by an administrator who configured volume encryption through the Storage Manager interface. The attacker extracts encryption passphrases or key material embedded as plaintext query parameters in logged GET request URLs, then uses those credentials to unlock or decrypt protected storage volumes. No public exploit code exists at time of analysis, and the attack requires targeted local access rather than opportunistic automated exploitation.