Diskstation Manager Dsm
Monthly
Man-in-the-middle attackers positioned on the network path between a Synology DiskStation and its configured mail server can exploit improper TLS certificate validation in the DSM Email API to read or write arbitrary files and trigger denial-of-service conditions. The flaw affects DSM builds before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2, and is rated CVSS 7.1 with an adjacent-network, high-complexity, unauthenticated vector requiring some user interaction. Exploitation demands that the appliance actually send email and that an email-sending action be triggered, so this is a genuine but hard-to-exploit MITM issue rather than a mass-exploitable one; no public exploit identified at time of analysis, and CISA KEV status is not indicated.
CRLF injection in the Synology DiskStation Manager (DSM) User API lets a remote, low-privileged authenticated user (PR:L) who can also induce limited user interaction (UI:R) read or write arbitrary files on the appliance and trigger a denial-of-service condition that surfaces only after the next reboot. Deployments running DSM before 7.2.1-69057-10, before 7.2.2-72806-7, or before 7.3.2-86009-2 are affected; there is no public exploit identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV). Because the flaw is a file read/write primitive, integrity and confidentiality impact is high, but it is gated behind a valid low-privileged DSM account rather than being unauthenticated mass-exploitable, and vendor-released fixed builds eliminate exposure.
An external control of file name or path flaw in the Synology DiskStation Manager (DSM) Upload API allows remote authenticated users to write files to arbitrary locations on the appliance, which can be leveraged for data integrity tampering and denial-of-service against the NAS. The defect is reachable over the network with low attack complexity and no user interaction, but it requires a valid DSM account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, base 8.1 High), so practical exposure is concentrated on low-privilege or compromised accounts and on DSM instances whose login interface faces untrusted networks. Affected builds are DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation. The dual integrity-and-availability impact, with no confidentiality effect, is what drives the High severity rating.
Authenticated remote attackers holding low-privileged credentials can exploit an incorrect permission assignment in the LDAP API of Synology DiskStation Manager to read or write arbitrary files and to trigger denial-of-service conditions, giving full loss of confidentiality, integrity, and availability on affected systems per the assessed vector (CVSS 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The vulnerability affects DSM builds before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075, with realistic exposure concentrated in NAS deployments that expose the management interface and run directory-services/LDAP functionality. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and the authentication requirement plus the need for a network-reachable DSM instance are the primary factors limiting real-world abuse.
Synology DiskStation Manager (DSM) login logic uses insufficiently random values, letting remote unauthenticated attackers (CVSS PR:N) read or write arbitrary files and mount denial-of-service attacks on NAS devices running DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075. Synology rates the flaw 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), while independent assessment keeps the same impact but raises attack complexity to High, since the attacker must successfully predict or reproduce the weakly-random login value, potentially requiring repeated attempts or offline computation. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but the unaudited attack surface (DSM's web login on typical management ports) and full CIA impact make prompt patching the priority for any internet-reachable instance.
Improper output encoding in the SCGI service of Synology DiskStation Manager (DSM) lets unauthenticated remote attackers read or write arbitrary files on the appliance and mount denial-of-service attacks against it. Every DSM build prior to 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, or 7.4-90075 is affected, and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, 9.8) confirms no credentials, user interaction, or non-default settings are needed - the only real precondition is network reachability to the SCGI interface, which makes internet-facing NAS units the highest-risk deployments while firewall/VPN-isolated devices carry substantially lower risk. No public exploit code has been identified at the time of analysis and the issue is not in CISA KEV, but the combination of full confidentiality, integrity, and availability impact with no authentication requirement makes rapid patching a priority.
Information disclosure in Synology DiskStation Manager (DSM) lets unauthenticated remote attackers read a limited set of files by overwhelming the built-in Auto Block brute-force protection with sustained authentication attempts. The root cause is an improper restriction of excessive authentication attempts (CWE-307), and exploitation is technically difficult (CVSS 3.7, AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) with the payoff confined to low-confidentiality reads and no write or denial-of-service capability. Affected versions are DSM before 7.2.1-69057-10, 7.2.2-72806-7, and 7.3.2-86009-2; no public exploit identified at time of analysis, and this remains a low-priority finding despite being remotely reachable and unauthenticated.
Unauthenticated path traversal in the Synology DiskStation Manager (DSM) Desktop API allows remote attackers to write a limited set of files and cause a limited denial-of-service condition on DSM instances older than 7.2.1-69057-10, 7.2.2-72806-7, or 7.3.2-86009-2. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, exploitation requires only network reachability to the DSM web management interface - no credentials or user interaction - though the impact is deliberately bounded: there is no confidentiality loss (C:N), with only low integrity and low availability effects from constrained file writes and partial service disruption. No public exploit code or confirmed in-the-wild exploitation has been identified at time of analysis, and an EPSS score was not available in the supplied intelligence.
Unauthenticated remote attackers can query the Desktop API in Synology DiskStation Manager (DSM) to retrieve non-sensitive information, affecting DSM versions before 7.2.1-69057-10, 7.2.2-72806-7, and 7.3.2-86009-2. The CVSS 3.1 score is 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), and while no public exploit code or active exploitation has been identified at time of analysis, the flaw still offers reconnaissance value because no authentication or user interaction is required. Given the limited confidentiality impact and lack of integrity or availability effects, this is a low-priority issue, with risk primarily determined by whether the DSM management interface is internet-facing.
Server-side request forgery in the PersonMail API of Synology DiskStation Manager (DSM) allows an authenticated low-privilege user to coerce the appliance into making arbitrary requests, potentially retrieving non-sensitive information from internal or external endpoints. The flaw affects DSM versions before 7.2.1-69057-10, 7.2.2-72806-7, and 7.3.2-86009-2, and carries a CVSS 3.1 score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). No public exploit code or active exploitation has been identified at time of analysis, and the vendor rates the confidentiality impact as limited to non-sensitive data with no integrity or availability effect.
Path traversal in the Audio API of Synology DiskStation Manager (DSM) allows remote authenticated users to read files outside the intended directory, though the vendor explicitly scopes the exposed content as non-sensitive information. Affected are DSM installations before 7.2.1-69057-10, before 7.2.2-72806-7, and before 7.3.2-86009-2; the flaw is network-reachable (AV:N) but requires a valid DSM account (PR:L) and needs no user interaction, and it carries no write or availability impact (CVSS 3.1 base 4.3). There is no public exploit identified at time of analysis, and the combination of the authentication prerequisite with the non-sensitive nature of the disclosed data keeps realistic risk low.
Cross-site scripting in the Video API of Synology DiskStation Manager (DSM) allows a remote authenticated user to read or write a limited set of files in the context of a victim's browser session when the video player is launched. Affected builds are DSM before 7.2.1-69057-10, 7.2.2-72806-7, and 7.3.2-86009-2; exploitation requires a valid DSM account with Video API access plus victim interaction (launching the player), and impact is bounded to low-confidentiality and low-integrity file access rather than code execution. No public exploit code or confirmed active exploitation is identified in the available data, and the CVSS 5.4 / EPSS-consistent profile places this as routine-priority patching.
Information disclosure in Synology DiskStation Manager (DSM) allows remote authenticated users to obtain sensitive information by directly requesting the Wallpaper Path resource, bypassing intended navigation controls. Affected versions are DSM before 7.2.1-69057-10, 7.2.2-72806-7, and 7.3.2-86009-2. Exploitation requires a valid DSM account (PR:L) and network access to the DSM web interface; no public exploit identified at time of analysis. Vendor patches are available in the listed fixed builds.
Integer overflow in the File Operation component of Synology DiskStation Manager (DSM) allows remote authenticated users to trigger a limited denial-of-service condition against affected NAS appliances. Only systems running DSM versions prior to 7.2.1-69057-10, 7.2.2-72806-7, or 7.3.2-86009-2 are affected; the vulnerability requires a valid DSM account with rights to invoke File Operation, matching the CVSS vector's PR:L (authenticated) rating. Impact is confined to low availability loss with no confidentiality or integrity effect, no public exploit code has been identified at time of analysis, and EPSS/KEV data do not indicate active exploitation, making this a low-priority issue despite the network attack vector.
An authenticated SQL injection in the Sharing API of Synology DiskStation Manager (DSM) allows remote users with valid - even low-privilege - DSM credentials to read arbitrary sharing files they should not be able to access. The flaw (CWE-89) affects DSM builds prior to 7.2.1-69057-10, 7.2.2-72806-7, and 7.3.2-86009-2, and is constrained by its credential prerequisite: no user interaction is required, but a logged-in session is, which limits it to a confidentiality-only impact (CVSS 6.5, C:H/I:N/A:N) rather than full system compromise. At time of analysis there is no CISA KEV listing and no public exploit code identified, so the practical risk is a bounded data-disclosure issue for organizations that expose the DSM Sharing API to untrusted or broad authenticated user populations.
A SQL injection vulnerability in the EventScheduler API of Synology DiskStation Manager (DSM) allows an authenticated remote attacker with administrator privileges to retrieve non-sensitive information from the underlying database. Affected versions include DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075. The CVSS score of 2.7 (Low) accurately reflects the limited impact, and no public exploit has been identified at time of analysis. The primary limiting factor is the requirement for high-privileged (admin) access to the DSM management interface.
Cross-site scripting in the Synology DiskStation Manager (DSM) Theme API lets a remote attacker who already holds DSM administrator privileges inject script that executes in another DSM user's authenticated session, enabling limited file read and write through that session. Exploitation requires the privileged attacker to inject the payload and a separate victim to interact with the affected web page (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N, base score 4.8); the scope change reflects that the injected script can act outside the attacker's own session, but the confidentiality and integrity impact remain limited. Only DSM builds prior to 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 are affected, and there is no public exploit identified at time of analysis. This is a low-priority, defense-in-depth issue rather than an urgent one, since the attacker must already be an administrator before the flaw grants anything.
Improper neutralization of CRLF sequences in the Sharing API of Synology DiskStation Manager (DSM) allows remote authenticated users to write limited files on the appliance when a victim clicks an attacker-crafted sharing URL. The issue affects DSM builds prior to 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075, and is scored CVSS 3.1 3.5 (AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) - a low-priority rating the vector fairly reflects, since exploitation requires both a valid low-privileged DSM account and a victim's click-through, and yields only a low integrity impact with no confidentiality or availability loss. No public exploit identified at time of analysis, and the flaw is not listed as confirmed actively exploited (CISA KEV).
Improper encoding and escaping of output in the Auth API of Synology DiskStation Manager (DSM) lets remote, unauthenticated attackers retrieve information the vendor classifies as non-sensitive, affecting deployments before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, 5.3) confirms exploitation needs no credentials, no user interaction, and no non-default configuration, so the only meaningful barrier is impact rather than access. There is no public exploit identified at time of analysis and no KEV listing, and because disclosure is limited to non-sensitive information, the practical value to an attacker is reconnaissance and fingerprinting rather than direct compromise; vendor-released patches exist in the fixed DSM builds published under Synology advisory SA_26_13.
Man-in-the-middle attackers positioned on the network path between a Synology DiskStation and its configured mail server can exploit improper TLS certificate validation in the DSM Email API to read or write arbitrary files and trigger denial-of-service conditions. The flaw affects DSM builds before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2, and is rated CVSS 7.1 with an adjacent-network, high-complexity, unauthenticated vector requiring some user interaction. Exploitation demands that the appliance actually send email and that an email-sending action be triggered, so this is a genuine but hard-to-exploit MITM issue rather than a mass-exploitable one; no public exploit identified at time of analysis, and CISA KEV status is not indicated.
CRLF injection in the Synology DiskStation Manager (DSM) User API lets a remote, low-privileged authenticated user (PR:L) who can also induce limited user interaction (UI:R) read or write arbitrary files on the appliance and trigger a denial-of-service condition that surfaces only after the next reboot. Deployments running DSM before 7.2.1-69057-10, before 7.2.2-72806-7, or before 7.3.2-86009-2 are affected; there is no public exploit identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV). Because the flaw is a file read/write primitive, integrity and confidentiality impact is high, but it is gated behind a valid low-privileged DSM account rather than being unauthenticated mass-exploitable, and vendor-released fixed builds eliminate exposure.
An external control of file name or path flaw in the Synology DiskStation Manager (DSM) Upload API allows remote authenticated users to write files to arbitrary locations on the appliance, which can be leveraged for data integrity tampering and denial-of-service against the NAS. The defect is reachable over the network with low attack complexity and no user interaction, but it requires a valid DSM account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, base 8.1 High), so practical exposure is concentrated on low-privilege or compromised accounts and on DSM instances whose login interface faces untrusted networks. Affected builds are DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation. The dual integrity-and-availability impact, with no confidentiality effect, is what drives the High severity rating.
Authenticated remote attackers holding low-privileged credentials can exploit an incorrect permission assignment in the LDAP API of Synology DiskStation Manager to read or write arbitrary files and to trigger denial-of-service conditions, giving full loss of confidentiality, integrity, and availability on affected systems per the assessed vector (CVSS 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The vulnerability affects DSM builds before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075, with realistic exposure concentrated in NAS deployments that expose the management interface and run directory-services/LDAP functionality. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and the authentication requirement plus the need for a network-reachable DSM instance are the primary factors limiting real-world abuse.
Synology DiskStation Manager (DSM) login logic uses insufficiently random values, letting remote unauthenticated attackers (CVSS PR:N) read or write arbitrary files and mount denial-of-service attacks on NAS devices running DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075. Synology rates the flaw 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), while independent assessment keeps the same impact but raises attack complexity to High, since the attacker must successfully predict or reproduce the weakly-random login value, potentially requiring repeated attempts or offline computation. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but the unaudited attack surface (DSM's web login on typical management ports) and full CIA impact make prompt patching the priority for any internet-reachable instance.
Improper output encoding in the SCGI service of Synology DiskStation Manager (DSM) lets unauthenticated remote attackers read or write arbitrary files on the appliance and mount denial-of-service attacks against it. Every DSM build prior to 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, or 7.4-90075 is affected, and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, 9.8) confirms no credentials, user interaction, or non-default settings are needed - the only real precondition is network reachability to the SCGI interface, which makes internet-facing NAS units the highest-risk deployments while firewall/VPN-isolated devices carry substantially lower risk. No public exploit code has been identified at the time of analysis and the issue is not in CISA KEV, but the combination of full confidentiality, integrity, and availability impact with no authentication requirement makes rapid patching a priority.
Information disclosure in Synology DiskStation Manager (DSM) lets unauthenticated remote attackers read a limited set of files by overwhelming the built-in Auto Block brute-force protection with sustained authentication attempts. The root cause is an improper restriction of excessive authentication attempts (CWE-307), and exploitation is technically difficult (CVSS 3.7, AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) with the payoff confined to low-confidentiality reads and no write or denial-of-service capability. Affected versions are DSM before 7.2.1-69057-10, 7.2.2-72806-7, and 7.3.2-86009-2; no public exploit identified at time of analysis, and this remains a low-priority finding despite being remotely reachable and unauthenticated.
Unauthenticated path traversal in the Synology DiskStation Manager (DSM) Desktop API allows remote attackers to write a limited set of files and cause a limited denial-of-service condition on DSM instances older than 7.2.1-69057-10, 7.2.2-72806-7, or 7.3.2-86009-2. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, exploitation requires only network reachability to the DSM web management interface - no credentials or user interaction - though the impact is deliberately bounded: there is no confidentiality loss (C:N), with only low integrity and low availability effects from constrained file writes and partial service disruption. No public exploit code or confirmed in-the-wild exploitation has been identified at time of analysis, and an EPSS score was not available in the supplied intelligence.
Unauthenticated remote attackers can query the Desktop API in Synology DiskStation Manager (DSM) to retrieve non-sensitive information, affecting DSM versions before 7.2.1-69057-10, 7.2.2-72806-7, and 7.3.2-86009-2. The CVSS 3.1 score is 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), and while no public exploit code or active exploitation has been identified at time of analysis, the flaw still offers reconnaissance value because no authentication or user interaction is required. Given the limited confidentiality impact and lack of integrity or availability effects, this is a low-priority issue, with risk primarily determined by whether the DSM management interface is internet-facing.
Server-side request forgery in the PersonMail API of Synology DiskStation Manager (DSM) allows an authenticated low-privilege user to coerce the appliance into making arbitrary requests, potentially retrieving non-sensitive information from internal or external endpoints. The flaw affects DSM versions before 7.2.1-69057-10, 7.2.2-72806-7, and 7.3.2-86009-2, and carries a CVSS 3.1 score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). No public exploit code or active exploitation has been identified at time of analysis, and the vendor rates the confidentiality impact as limited to non-sensitive data with no integrity or availability effect.
Path traversal in the Audio API of Synology DiskStation Manager (DSM) allows remote authenticated users to read files outside the intended directory, though the vendor explicitly scopes the exposed content as non-sensitive information. Affected are DSM installations before 7.2.1-69057-10, before 7.2.2-72806-7, and before 7.3.2-86009-2; the flaw is network-reachable (AV:N) but requires a valid DSM account (PR:L) and needs no user interaction, and it carries no write or availability impact (CVSS 3.1 base 4.3). There is no public exploit identified at time of analysis, and the combination of the authentication prerequisite with the non-sensitive nature of the disclosed data keeps realistic risk low.
Cross-site scripting in the Video API of Synology DiskStation Manager (DSM) allows a remote authenticated user to read or write a limited set of files in the context of a victim's browser session when the video player is launched. Affected builds are DSM before 7.2.1-69057-10, 7.2.2-72806-7, and 7.3.2-86009-2; exploitation requires a valid DSM account with Video API access plus victim interaction (launching the player), and impact is bounded to low-confidentiality and low-integrity file access rather than code execution. No public exploit code or confirmed active exploitation is identified in the available data, and the CVSS 5.4 / EPSS-consistent profile places this as routine-priority patching.
Information disclosure in Synology DiskStation Manager (DSM) allows remote authenticated users to obtain sensitive information by directly requesting the Wallpaper Path resource, bypassing intended navigation controls. Affected versions are DSM before 7.2.1-69057-10, 7.2.2-72806-7, and 7.3.2-86009-2. Exploitation requires a valid DSM account (PR:L) and network access to the DSM web interface; no public exploit identified at time of analysis. Vendor patches are available in the listed fixed builds.
Integer overflow in the File Operation component of Synology DiskStation Manager (DSM) allows remote authenticated users to trigger a limited denial-of-service condition against affected NAS appliances. Only systems running DSM versions prior to 7.2.1-69057-10, 7.2.2-72806-7, or 7.3.2-86009-2 are affected; the vulnerability requires a valid DSM account with rights to invoke File Operation, matching the CVSS vector's PR:L (authenticated) rating. Impact is confined to low availability loss with no confidentiality or integrity effect, no public exploit code has been identified at time of analysis, and EPSS/KEV data do not indicate active exploitation, making this a low-priority issue despite the network attack vector.
An authenticated SQL injection in the Sharing API of Synology DiskStation Manager (DSM) allows remote users with valid - even low-privilege - DSM credentials to read arbitrary sharing files they should not be able to access. The flaw (CWE-89) affects DSM builds prior to 7.2.1-69057-10, 7.2.2-72806-7, and 7.3.2-86009-2, and is constrained by its credential prerequisite: no user interaction is required, but a logged-in session is, which limits it to a confidentiality-only impact (CVSS 6.5, C:H/I:N/A:N) rather than full system compromise. At time of analysis there is no CISA KEV listing and no public exploit code identified, so the practical risk is a bounded data-disclosure issue for organizations that expose the DSM Sharing API to untrusted or broad authenticated user populations.
A SQL injection vulnerability in the EventScheduler API of Synology DiskStation Manager (DSM) allows an authenticated remote attacker with administrator privileges to retrieve non-sensitive information from the underlying database. Affected versions include DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075. The CVSS score of 2.7 (Low) accurately reflects the limited impact, and no public exploit has been identified at time of analysis. The primary limiting factor is the requirement for high-privileged (admin) access to the DSM management interface.
Cross-site scripting in the Synology DiskStation Manager (DSM) Theme API lets a remote attacker who already holds DSM administrator privileges inject script that executes in another DSM user's authenticated session, enabling limited file read and write through that session. Exploitation requires the privileged attacker to inject the payload and a separate victim to interact with the affected web page (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N, base score 4.8); the scope change reflects that the injected script can act outside the attacker's own session, but the confidentiality and integrity impact remain limited. Only DSM builds prior to 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 are affected, and there is no public exploit identified at time of analysis. This is a low-priority, defense-in-depth issue rather than an urgent one, since the attacker must already be an administrator before the flaw grants anything.
Improper neutralization of CRLF sequences in the Sharing API of Synology DiskStation Manager (DSM) allows remote authenticated users to write limited files on the appliance when a victim clicks an attacker-crafted sharing URL. The issue affects DSM builds prior to 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075, and is scored CVSS 3.1 3.5 (AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) - a low-priority rating the vector fairly reflects, since exploitation requires both a valid low-privileged DSM account and a victim's click-through, and yields only a low integrity impact with no confidentiality or availability loss. No public exploit identified at time of analysis, and the flaw is not listed as confirmed actively exploited (CISA KEV).
Improper encoding and escaping of output in the Auth API of Synology DiskStation Manager (DSM) lets remote, unauthenticated attackers retrieve information the vendor classifies as non-sensitive, affecting deployments before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, 5.3) confirms exploitation needs no credentials, no user interaction, and no non-default configuration, so the only meaningful barrier is impact rather than access. There is no public exploit identified at time of analysis and no KEV listing, and because disclosure is limited to non-sensitive information, the practical value to an attacker is reconnaissance and fingerprinting rather than direct compromise; vendor-released patches exist in the fixed DSM builds published under Synology advisory SA_26_13.