Synology
Monthly
Server-side request forgery in OpenClaw Gateway (npm-distributed, versions 2026.7.1 through 2026.8.0) lets an authenticated, write-scoped caller abuse Synology Chat attachment delivery: the Gateway validates a single DNS lookup for a supplied file URL but then hands the original hostname to the Synology NAS, which resolves it independently and can be steered to a private or policy-denied resource whose contents are returned to the addressed conversation. Reaching that outcome requires remote URL attachment forwarding to be enabled, the Gateway to accept a remotely-influenced hostname, and the attacker to win a DNS rebinding race against the NAS's own resolution, so practical impact hinges on NAS routing, resolver behavior, and whether a useful response exists at the private destination; no public exploit code has been identified at time of analysis. The vendor CVSS 4.0 rating is 7.1 (HIGH), but our independent assessment scores it CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N, arguing for a lower real-world priority given the non-default feature-specific pathway, the PR:L authentication requirement, and the narrow affected window that is closed by upgrading to 2026.8.1.
Man-in-the-middle attackers positioned on the network path between a Synology DiskStation and its configured mail server can exploit improper TLS certificate validation in the DSM Email API to read or write arbitrary files and trigger denial-of-service conditions. The flaw affects DSM builds before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2, and is rated CVSS 7.1 with an adjacent-network, high-complexity, unauthenticated vector requiring some user interaction. Exploitation demands that the appliance actually send email and that an email-sending action be triggered, so this is a genuine but hard-to-exploit MITM issue rather than a mass-exploitable one; no public exploit identified at time of analysis, and CISA KEV status is not indicated.
CRLF injection in the Synology DiskStation Manager (DSM) User API lets a remote, low-privileged authenticated user (PR:L) who can also induce limited user interaction (UI:R) read or write arbitrary files on the appliance and trigger a denial-of-service condition that surfaces only after the next reboot. Deployments running DSM before 7.2.1-69057-10, before 7.2.2-72806-7, or before 7.3.2-86009-2 are affected; there is no public exploit identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV). Because the flaw is a file read/write primitive, integrity and confidentiality impact is high, but it is gated behind a valid low-privileged DSM account rather than being unauthenticated mass-exploitable, and vendor-released fixed builds eliminate exposure.
An external control of file name or path flaw in the Synology DiskStation Manager (DSM) Upload API allows remote authenticated users to write files to arbitrary locations on the appliance, which can be leveraged for data integrity tampering and denial-of-service against the NAS. The defect is reachable over the network with low attack complexity and no user interaction, but it requires a valid DSM account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, base 8.1 High), so practical exposure is concentrated on low-privilege or compromised accounts and on DSM instances whose login interface faces untrusted networks. Affected builds are DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation. The dual integrity-and-availability impact, with no confidentiality effect, is what drives the High severity rating.
Authenticated remote attackers holding low-privileged credentials can exploit an incorrect permission assignment in the LDAP API of Synology DiskStation Manager to read or write arbitrary files and to trigger denial-of-service conditions, giving full loss of confidentiality, integrity, and availability on affected systems per the assessed vector (CVSS 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The vulnerability affects DSM builds before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075, with realistic exposure concentrated in NAS deployments that expose the management interface and run directory-services/LDAP functionality. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and the authentication requirement plus the need for a network-reachable DSM instance are the primary factors limiting real-world abuse.
Synology DiskStation Manager (DSM) login logic uses insufficiently random values, letting remote unauthenticated attackers (CVSS PR:N) read or write arbitrary files and mount denial-of-service attacks on NAS devices running DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075. Synology rates the flaw 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), while independent assessment keeps the same impact but raises attack complexity to High, since the attacker must successfully predict or reproduce the weakly-random login value, potentially requiring repeated attempts or offline computation. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but the unaudited attack surface (DSM's web login on typical management ports) and full CIA impact make prompt patching the priority for any internet-reachable instance.
Improper output encoding in the SCGI service of Synology DiskStation Manager (DSM) lets unauthenticated remote attackers read or write arbitrary files on the appliance and mount denial-of-service attacks against it. Every DSM build prior to 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, or 7.4-90075 is affected, and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, 9.8) confirms no credentials, user interaction, or non-default settings are needed - the only real precondition is network reachability to the SCGI interface, which makes internet-facing NAS units the highest-risk deployments while firewall/VPN-isolated devices carry substantially lower risk. No public exploit code has been identified at the time of analysis and the issue is not in CISA KEV, but the combination of full confidentiality, integrity, and availability impact with no authentication requirement makes rapid patching a priority.
Stored/reflected cross-site scripting in Synology Chat Server before 2.4.5-22148 lets a remote authenticated user who lures a victim into a UI interaction execute injected script that pivots into the underlying DSM platform to read or write arbitrary files and trigger denial-of-service. The vendor-assigned CVSS 9.0 reflects a scope change (S:C) where compromise of the chat add-on cascades into the host DiskStation Manager operating system. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Incorrect default permissions in Synology Assistant before version 7.0.7-50095 expose locally created installation artifacts to unauthorized access, enabling low-privileged local users to read or write arbitrary files and trigger denial-of-service conditions during the installation window. The CVSS score of 7.3 (High) with C:H/I:H/A:H reflects the breadth of potential file system impact, though an EPSS of 0.13% (3rd percentile) and SSVC exploitation status of 'none' confirm no public exploitation activity at time of analysis. A vendor-released patch exists at version 7.0.7-50095, and no public exploit code has been identified.
Synology OpenClaw versions 2026.2.22 and 2026.2.23 contain an authorization bypass in the synology-chat channel plugin where misconfigured allowlist policies with empty user IDs fail open, allowing authenticated Synology senders to dispatch unauthorized agents and execute downstream tool actions. The vulnerability requires network access and low-complexity exploitation, with a patch currently available.
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) was mishandled in the development of some or all operating-system kernels,. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
Command injection vulnerability in smart.cgi in Synology DiskStation Manager (DSM) before 5.2-5967-5 allows remote authenticated users to execute arbitrary commands via disk field. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 62.4%.
webman/imageSelector.cgi in Synology DiskStation Manager (DSM) 4.0 before 4.0-2259, 4.2 before 4.2-3243, and 4.3 before 4.3-3810 Update 1 allows remote attackers to append data to arbitrary files,. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 83.3%.
Unauthenticated senders can temporarily disable OpenClaw's Synology Chat webhook integration by exhausting a shared invalid-token rate-limit budget on versions 2026.3.25 through 2026.8.1. Because the limiter is applied before authentication and keyed on the raw proxy socket address, any deployment where OpenClaw sits behind a reverse proxy or tunnel causes all external clients to share one counter, so junk webhook calls from a single source can cause legitimate Synology Chat callbacks to be rejected until the rate-limit window resets. The attacker gains no token and no message data - this is a scoped, temporary availability loss (CVSS 4.0 base 6.9, AV:N/PR:N/VA:L) with no public exploit identified at time of analysis, and it is assessed as a genuinely low-priority DoS issue; the vendor-released fix is 2026.8.1.
Information disclosure in Synology DiskStation Manager (DSM) lets unauthenticated remote attackers read a limited set of files by overwhelming the built-in Auto Block brute-force protection with sustained authentication attempts. The root cause is an improper restriction of excessive authentication attempts (CWE-307), and exploitation is technically difficult (CVSS 3.7, AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) with the payoff confined to low-confidentiality reads and no write or denial-of-service capability. Affected versions are DSM before 7.2.1-69057-10, 7.2.2-72806-7, and 7.3.2-86009-2; no public exploit identified at time of analysis, and this remains a low-priority finding despite being remotely reachable and unauthenticated.
Unauthenticated path traversal in the Synology DiskStation Manager (DSM) Desktop API allows remote attackers to write a limited set of files and cause a limited denial-of-service condition on DSM instances older than 7.2.1-69057-10, 7.2.2-72806-7, or 7.3.2-86009-2. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, exploitation requires only network reachability to the DSM web management interface - no credentials or user interaction - though the impact is deliberately bounded: there is no confidentiality loss (C:N), with only low integrity and low availability effects from constrained file writes and partial service disruption. No public exploit code or confirmed in-the-wild exploitation has been identified at time of analysis, and an EPSS score was not available in the supplied intelligence.
Unauthenticated remote attackers can query the Desktop API in Synology DiskStation Manager (DSM) to retrieve non-sensitive information, affecting DSM versions before 7.2.1-69057-10, 7.2.2-72806-7, and 7.3.2-86009-2. The CVSS 3.1 score is 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), and while no public exploit code or active exploitation has been identified at time of analysis, the flaw still offers reconnaissance value because no authentication or user interaction is required. Given the limited confidentiality impact and lack of integrity or availability effects, this is a low-priority issue, with risk primarily determined by whether the DSM management interface is internet-facing.
Server-side request forgery in the PersonMail API of Synology DiskStation Manager (DSM) allows an authenticated low-privilege user to coerce the appliance into making arbitrary requests, potentially retrieving non-sensitive information from internal or external endpoints. The flaw affects DSM versions before 7.2.1-69057-10, 7.2.2-72806-7, and 7.3.2-86009-2, and carries a CVSS 3.1 score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). No public exploit code or active exploitation has been identified at time of analysis, and the vendor rates the confidentiality impact as limited to non-sensitive data with no integrity or availability effect.
Path traversal in the Audio API of Synology DiskStation Manager (DSM) allows remote authenticated users to read files outside the intended directory, though the vendor explicitly scopes the exposed content as non-sensitive information. Affected are DSM installations before 7.2.1-69057-10, before 7.2.2-72806-7, and before 7.3.2-86009-2; the flaw is network-reachable (AV:N) but requires a valid DSM account (PR:L) and needs no user interaction, and it carries no write or availability impact (CVSS 3.1 base 4.3). There is no public exploit identified at time of analysis, and the combination of the authentication prerequisite with the non-sensitive nature of the disclosed data keeps realistic risk low.
Cross-site scripting in the Video API of Synology DiskStation Manager (DSM) allows a remote authenticated user to read or write a limited set of files in the context of a victim's browser session when the video player is launched. Affected builds are DSM before 7.2.1-69057-10, 7.2.2-72806-7, and 7.3.2-86009-2; exploitation requires a valid DSM account with Video API access plus victim interaction (launching the player), and impact is bounded to low-confidentiality and low-integrity file access rather than code execution. No public exploit code or confirmed active exploitation is identified in the available data, and the CVSS 5.4 / EPSS-consistent profile places this as routine-priority patching.
Information disclosure in Synology DiskStation Manager (DSM) allows remote authenticated users to obtain sensitive information by directly requesting the Wallpaper Path resource, bypassing intended navigation controls. Affected versions are DSM before 7.2.1-69057-10, 7.2.2-72806-7, and 7.3.2-86009-2. Exploitation requires a valid DSM account (PR:L) and network access to the DSM web interface; no public exploit identified at time of analysis. Vendor patches are available in the listed fixed builds.
Integer overflow in the File Operation component of Synology DiskStation Manager (DSM) allows remote authenticated users to trigger a limited denial-of-service condition against affected NAS appliances. Only systems running DSM versions prior to 7.2.1-69057-10, 7.2.2-72806-7, or 7.3.2-86009-2 are affected; the vulnerability requires a valid DSM account with rights to invoke File Operation, matching the CVSS vector's PR:L (authenticated) rating. Impact is confined to low availability loss with no confidentiality or integrity effect, no public exploit code has been identified at time of analysis, and EPSS/KEV data do not indicate active exploitation, making this a low-priority issue despite the network attack vector.
An authenticated SQL injection in the Sharing API of Synology DiskStation Manager (DSM) allows remote users with valid - even low-privilege - DSM credentials to read arbitrary sharing files they should not be able to access. The flaw (CWE-89) affects DSM builds prior to 7.2.1-69057-10, 7.2.2-72806-7, and 7.3.2-86009-2, and is constrained by its credential prerequisite: no user interaction is required, but a logged-in session is, which limits it to a confidentiality-only impact (CVSS 6.5, C:H/I:N/A:N) rather than full system compromise. At time of analysis there is no CISA KEV listing and no public exploit code identified, so the practical risk is a bounded data-disclosure issue for organizations that expose the DSM Sharing API to untrusted or broad authenticated user populations.
A SQL injection vulnerability in the EventScheduler API of Synology DiskStation Manager (DSM) allows an authenticated remote attacker with administrator privileges to retrieve non-sensitive information from the underlying database. Affected versions include DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075. The CVSS score of 2.7 (Low) accurately reflects the limited impact, and no public exploit has been identified at time of analysis. The primary limiting factor is the requirement for high-privileged (admin) access to the DSM management interface.
Cross-site scripting in the Synology DiskStation Manager (DSM) Theme API lets a remote attacker who already holds DSM administrator privileges inject script that executes in another DSM user's authenticated session, enabling limited file read and write through that session. Exploitation requires the privileged attacker to inject the payload and a separate victim to interact with the affected web page (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N, base score 4.8); the scope change reflects that the injected script can act outside the attacker's own session, but the confidentiality and integrity impact remain limited. Only DSM builds prior to 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 are affected, and there is no public exploit identified at time of analysis. This is a low-priority, defense-in-depth issue rather than an urgent one, since the attacker must already be an administrator before the flaw grants anything.
Improper neutralization of CRLF sequences in the Sharing API of Synology DiskStation Manager (DSM) allows remote authenticated users to write limited files on the appliance when a victim clicks an attacker-crafted sharing URL. The issue affects DSM builds prior to 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075, and is scored CVSS 3.1 3.5 (AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) - a low-priority rating the vector fairly reflects, since exploitation requires both a valid low-privileged DSM account and a victim's click-through, and yields only a low integrity impact with no confidentiality or availability loss. No public exploit identified at time of analysis, and the flaw is not listed as confirmed actively exploited (CISA KEV).
Improper encoding and escaping of output in the Auth API of Synology DiskStation Manager (DSM) lets remote, unauthenticated attackers retrieve information the vendor classifies as non-sensitive, affecting deployments before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, 5.3) confirms exploitation needs no credentials, no user interaction, and no non-default configuration, so the only meaningful barrier is impact rather than access. There is no public exploit identified at time of analysis and no KEV listing, and because disclosure is limited to non-sensitive information, the practical value to an attacker is reconnaissance and fingerprinting rather than direct compromise; vendor-released patches exist in the fixed DSM builds published under Synology advisory SA_26_13.
Cross-site scripting in Synology Chat Server's extract domain feature allows authenticated remote users to inject malicious scripts that execute upon victim UI interaction, with impact extending beyond the Chat application into the broader DSM (DiskStation Manager) environment. The scope change captured in the CVSS vector (S:C) is the key risk amplifier: successful exploitation can result in reading or writing restricted DSM files and conducting limited denial-of-service against DSM. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available.
Server-Side Request Forgery in Synology Chat Server's webhook functionality allows remote authenticated users to probe internal or external network resources and retrieve non-sensitive information. Affected versions are all Chat Server releases prior to 2.4.5-22148. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog; however, the authenticated network attack vector and low complexity make this straightforward to exploit for any valid user of the application.
An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in Backup Task functionality in Synology Hyper Backup before 4.1.2-4036 allows remote authenticated. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.
An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in Backup.Repository webapi component in Synology Hyper Backup before 4.1.2-4036 allows remote. Rated medium severity (CVSS 4.1), this vulnerability is remotely exploitable, low attack complexity.
A cleartext transmission of sensitive information vulnerability in Synology Note Station Client before 2.2.4-703 allows man-in-the-middle attackers to obtain user credential. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required.
An inclusion of functionality from untrusted control sphere vulnerability in MinGW DLL component in Synology Hyper Backup Explorer before 3.0.1-0156 allows local users to execute arbitrary code via. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
An inclusion of functionality from untrusted control sphere vulnerability in OpenSSL configuration in Synology Active Backup for Business Recovery Media Creator before 2.5.0-2081 allows local users. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
Volume encryption in Synology Storage Manager before version 1.0.1-1100 transmits sensitive data via HTTP GET query strings, exposing encryption-related secrets to local attackers who can access web server logs, browser history, or other locally readable URL artifacts. The flaw (CWE-598) requires no privileges or user interaction beyond local system presence, and carries a High confidentiality impact rating because credentials or passphrases associated with volume encryption may be recoverable from logged GET requests. No public exploit exists and EPSS sits at the 1st percentile, indicating no widespread exploitation activity at time of analysis.
Synology Assistant before version 7.0.6-50085 exposes local users to arbitrary file write with restricted content via an origin validation error triggered during the installation process. The CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H) indicates that while integrity impact is limited, availability impact is rated High - meaning an attacker can corrupt or overwrite files in ways that destabilize the system, even though the written content is constrained. No public exploit code exists and CISA has not added this to KEV; EPSS stands at 0.00%, reflecting minimal observed exploitation interest.
Synology Active Backup for Business Agent before version 3.1.0-4967 contains an origin validation error (CWE-346) that permits local users to write arbitrary files with restricted content during the installation process, resulting in high availability impact and limited integrity compromise. The CVSS vector (AV:L/PR:N/UI:R) indicates exploitation requires local system access and user interaction - specifically, the installation must be in progress. No public exploit code has been identified and EPSS sits at 0.00%, aligning with SSVC's 'exploitation: none' assessment, indicating this is a low-urgency but legitimate local privilege abuse risk during deployment windows.
Arbitrary file disclosure in Synology Active Backup for Business (DSM add-on package, versions before 2.7.1-3234) lets unauthenticated remote attackers read sensitive files on the host via a SQL injection flaw (CWE-89). The vulnerability scores CVSS 8.6 with a changed scope and high confidentiality impact, but EPSS estimates only a 0.04% (14th percentile) exploitation probability, and there is no public exploit identified at time of analysis nor any CISA KEV listing. Synology, who self-reported the issue, has released a fixed package.
Credential disclosure in Synology C2 Identity Edge Server (DSM versions before 1.76.0-0307) allows remote unauthenticated attackers to retrieve user credentials directly from the edge server over the network. The flaw stems from an exposed dangerous method/function (CWE-749) reachable without authentication, yielding a high-confidentiality impact with no integrity or availability effect. No public exploit has been identified at time of analysis, and EPSS scores it at the bottom 7th percentile, indicating low near-term exploitation likelihood despite the network-reachable vector.
Arbitrary file write with restricted content in Synology ActiveProtect Agent before 1.1.0-0439 is exploitable by local users during the installation process due to an origin validation error (CWE-346). The CVSS vector (AV:L/AC:L/PR:N/UI:R) indicates a low-complexity local attack requiring user interaction - consistent with exploitation during an installation workflow - and scores high on availability impact (A:H) while integrity impact is limited (I:L), suggesting the file write can disrupt system stability despite content restrictions. No public exploit code exists and CISA SSVC rates exploitation as none with partial technical impact.
Authentication bypass in the SSO component of Synology DiskStation Manager (DSM) allows remote, unauthenticated attackers to impersonate a user by supplying a distinguished name (DN) they already know, letting them skip normal credential verification entirely. Affected releases are DSM 7.2.2 before 7.2.2-72806-5 and DSM 7.3 before 7.3.1-86003-1; DSM 7.2.1-69057 is explicitly not affected, and the feature must be configured/enabled for a device to be exposed. There is no public exploit identified at time of analysis and EPSS is low (0.05%, 17th percentile), but exploitation is not automatable because the attacker needs prior knowledge of a valid DN, which is the main brake on mass scanning; CISA SSVC rates technical impact as total for a successfully targeted unit.
Cross-site scripting in Synology Contacts before version 1.0.10-20659 allows authenticated remote users to read or write specific files containing non-sensitive information by injecting malicious input through the contact functionality. The CVSS scope change (S:C) confirms the injected script executes in a context beyond the originating application, affecting any victim who views the crafted contact entry. No public exploit identified at time of analysis, and CISA has not listed this in the Known Exploited Vulnerabilities catalog.
Remote code execution in Synology BeeStation OS versions before 1.3.2-65648 stems from a classic buffer overflow in the AdminCenter component, the device's web-based management interface. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates a network-reachable flaw exploitable by unauthenticated attackers with low complexity and no user interaction, yielding full compromise of confidentiality, integrity, and availability (9.8 Critical). There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the unauthenticated network-RCE profile on a consumer NAS device makes this a high-priority patch target.
Stored XSS in Synology Safe Access before 1.3.1-0329 on SRM (Synology Router Manager) allows remote authenticated administrators to inject malicious scripts that execute in the SRM context, enabling limited reads or writes of non-sensitive files and constrained denial-of-service conditions. The CVSS Scope:Changed rating confirms cross-component impact - the vulnerability originates in the Safe Access module but affects the broader SRM platform. No public exploit code exists and no active exploitation has been identified; EPSS at 0.03% and SSVC exploitation status of 'none' collectively indicate negligible current threat in the wild.
Incorrect authorization vulnerability in IO Module functionality in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 allows remote authenticated users with administrator privileges to. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity.
Insufficiently protected credentials vulnerability in IPSpeaker component in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 allows remote authenticated users with administrator. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity.
Improper preservation of permissions vulnerability in Archiving Push functionality in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 allows remote authenticated users with. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity.
Cleartext transmission of sensitive information vulnerability in Export Key functionality in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 allows remote authenticated users with. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity.
Missing authorization vulnerability in AddOns functionality in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 allows remote authenticated users with administrator privileges to. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity.
Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in Archiving Pull functionality in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 allows. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity.
Files or directories accessible to external parties vulnerability in redis-server component in Synology BeeDrive for desktop before 1.3.2-13814 allows local users to conduct denial-of-service attacks. Rated medium severity (CVSS 6.8), this vulnerability is no authentication required, low attack complexity.
Uncontrolled search path element vulnerability in OpenSSL DLL component in Synology BeeDrive for desktop before 1.3.2-13814 allows local users to execute arbitrary code via unspecified vectors. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
OpenClaw before 2026.4.22 allows workspace dotenv files to override connector endpoint hosts for Matrix, Mattermost, IRC, and Synology connectors, enabling local attackers with workspace access to redirect runtime traffic to malicious endpoints. The vulnerability requires local access and user interaction but allows high confidentiality impact through traffic interception. No active exploitation has been identified, but a vendor-released patch is available.
A plaintext storage of a password vulnerability in Synology SSL VPN Client before 1.4.5-0684 allows remote attackers to access or influence the user's PIN code due to insecure storage. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A files or directories accessible to external parties vulnerability in Synology SSL VPN Client before 1.4.5-0684 allows remote attackers to access files within the installation directory via a local. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
OpenClaw before 2026.3.22 contains a webhook path route replacement vulnerability in its Synology Chat extension that allows unauthenticated remote attackers to bypass per-account direct message access controls by collapsing multi-account configurations onto shared webhook paths. Attackers can exploit inherited or duplicate webhook paths to replace route ownership across accounts, potentially gaining unauthorized access to account-specific resources. No public exploit code or active exploitation has been confirmed at the time of analysis.
Synology OpenClaw versions prior to 2026.2.24 contain an authorization bypass in the synology-chat channel plugin where misconfigured allowlist policies with empty user IDs fail to enforce access controls. Authenticated attackers with Synology sender privileges can exploit this flaw to send unauthorized messages through downstream agents and tools. A patch is available.
Synology Presto Client versions prior to 2.1.3-0672 are vulnerable to DLL hijacking during installation, enabling local attackers with user privileges to read or write arbitrary files by placing malicious libraries in the installer directory. The vulnerability requires user interaction and local access but grants high-impact capabilities including confidentiality and integrity violations. No patch is currently available.
Origin validation error vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.3-13973 allows local users to write arbitrary files with non-sensitive information via unspecified vectors.
Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.2-13960 allows local users to execute arbitrary code via unspecified vectors.
Missing authorization vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.2-13960 allows remote attackers to delete arbitrary files via unspecified vectors.
Missing authentication for critical function vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.2-13960 allows local users to execute arbitrary code via unspecified vectors.
A vulnerability in Synology Mail Server allows remote authenticated attackers to read and write non-sensitive settings, and disable some non-critical functions.
A vulnerability in portenable cgi allows remote authenticated users to get the status of installed packages.
A vulnerability in VideoPlayer2 subtitle cgi allows remote authenticated users to read .srt files.
A vulnerability in FileStation file cgi allows remote authenticated users to read file metadata and path information.
A vulnerability in FileStation thumb cgi allows remote authenticated users to read/write image files.
Improper control of dynamically-managed code resources vulnerability in WebAPI component in Synology DiskStation Manager (DSM) before 7.1.1-42962-8 and 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote authenticated users to obtain privileges without consent via unspecified vectors.
Out-of-bounds write vulnerability in cgi components in Synology DiskStation Manager (DSM) before 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote attackers to conduct denial-of-service attacks via unspecified vectors.
Cross-Site Request Forgery (CSRF) vulnerability in WebAPI Framework in Synology DiskStation Manager (DSM) before 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote attackers to execute arbitrary code via unspecified vectors.
Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Synology RADIUS Server allows remote authenticated users with administrator privileges to read or. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
CVE-2025-29885 is an improper certificate validation vulnerability in Synology File Station 5 that allows authenticated remote attackers to compromise system confidentiality, integrity, and availability. The vulnerability affects File Station 5 versions prior to 5.5.6.4791 and requires valid user credentials to exploit. With a CVSS score of 8.8 and a low attack complexity, this represents a significant risk to organizations running vulnerable versions, though exploitation requires prior authentication.
CVE-2025-29884 is an improper certificate validation vulnerability affecting Synology File Station 5 that allows authenticated remote attackers to compromise system confidentiality, integrity, and availability. The vulnerability requires user-level access but enables complete system compromise with high impact across all security dimensions. No active KEV or public POC data is currently available, but the CVSS 8.8 score and low attack complexity indicate this should be prioritized for patching.
Denial-of-service vulnerability in QNAP File Station 5 that allows an authenticated attacker to exhaust system resources without limits or throttling, preventing legitimate users and processes from accessing the affected service. The vulnerability affects File Station 5 versions prior to 5.5.6.4847 and is remotely exploitable with no user interaction required once account access is obtained. With a CVSS score of 7.5 (High) and network-based attack vector, this represents a significant availability risk for organizations relying on File Station for network file access.
A vulnerability in Synology Active Backup for Microsoft 365 allows remote authenticated attackers to obtain sensitive information via unspecified vectors. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Missing authorization vulnerability in synocopy in Synology DiskStation Manager (DSM) before 7.1.1-42962-8, 7.2.1-69057-7 and 7.2.2-72806-3 allows remote attackers to read arbitrary files via. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in the system syncing daemon in Synology Drive Server before 3.0.4-12699, 3.2.1-23280, 3.5.0-26085. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing authentication for critical function vulnerability in the webapi component in Synology Drive Server before 3.0.4-12699, 3.2.1-23280, 3.5.0-26085 and 3.5.1-26102 allows remote attackers to. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper encoding or escaping of output vulnerability in the webapi component in Synology BeeStation OS (BSM) before 1.1-65374 and Synology DiskStation Manager (DSM) before 7.1.1-42962-7,. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability regarding out-of-bounds read is found in the video interface. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Off-by-one error vulnerability in the transmission component in Synology Replication Service before 1.0.12-0066, 1.2.2-0353 and 1.3.0-0423 and Synology Unified Controller (DSMUC) before 3.1.4-23079. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper certificate validation vulnerability in the update functionality in Synology BeeStation OS (BSM) before 1.1-65374 and Synology DiskStation Manager (DSM) before 6.2.4-25556-8, 7.1.1-42962-7,. Rated medium severity (CVSS 4.3), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Improper certificate validation vulnerability in the LDAP utilities in Synology DiskStation Manager (DSM) before 7.1.1-42962-8, 7.2.1-69057-7 and 7.2.2-72806-3 allows man-in-the-middle attackers to. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Improper encoding or escaping of output vulnerability in the system plugin daemon in Synology BeeStation OS (BSM) before 1.1-65374 and Synology DiskStation Manager (DSM) before 7.2-64570-4,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in share file list functionality in Synology Active Backup for Business before 2.7.1-13234, 2.7.1-23234. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in encrypted share umount functionality in Synology Active Backup for Business before 2.7.1-13234,. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in agent-related functionality in Synology Active Backup for Business before 2.7.1-13234, 2.7.1-23234 and. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Authorization bypass through user-controlled key vulnerability in streaming service in Synology Media Server before 1.4-2680, 2.0.5-3152 and 2.2.0-3325 allows remote attackers to read specific files. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in DDNS Record functionality in Synology Router Manager (SRM) before 1.3.1-9346-10 allows remote. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Server-side request forgery in OpenClaw Gateway (npm-distributed, versions 2026.7.1 through 2026.8.0) lets an authenticated, write-scoped caller abuse Synology Chat attachment delivery: the Gateway validates a single DNS lookup for a supplied file URL but then hands the original hostname to the Synology NAS, which resolves it independently and can be steered to a private or policy-denied resource whose contents are returned to the addressed conversation. Reaching that outcome requires remote URL attachment forwarding to be enabled, the Gateway to accept a remotely-influenced hostname, and the attacker to win a DNS rebinding race against the NAS's own resolution, so practical impact hinges on NAS routing, resolver behavior, and whether a useful response exists at the private destination; no public exploit code has been identified at time of analysis. The vendor CVSS 4.0 rating is 7.1 (HIGH), but our independent assessment scores it CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N, arguing for a lower real-world priority given the non-default feature-specific pathway, the PR:L authentication requirement, and the narrow affected window that is closed by upgrading to 2026.8.1.
Man-in-the-middle attackers positioned on the network path between a Synology DiskStation and its configured mail server can exploit improper TLS certificate validation in the DSM Email API to read or write arbitrary files and trigger denial-of-service conditions. The flaw affects DSM builds before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2, and is rated CVSS 7.1 with an adjacent-network, high-complexity, unauthenticated vector requiring some user interaction. Exploitation demands that the appliance actually send email and that an email-sending action be triggered, so this is a genuine but hard-to-exploit MITM issue rather than a mass-exploitable one; no public exploit identified at time of analysis, and CISA KEV status is not indicated.
CRLF injection in the Synology DiskStation Manager (DSM) User API lets a remote, low-privileged authenticated user (PR:L) who can also induce limited user interaction (UI:R) read or write arbitrary files on the appliance and trigger a denial-of-service condition that surfaces only after the next reboot. Deployments running DSM before 7.2.1-69057-10, before 7.2.2-72806-7, or before 7.3.2-86009-2 are affected; there is no public exploit identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV). Because the flaw is a file read/write primitive, integrity and confidentiality impact is high, but it is gated behind a valid low-privileged DSM account rather than being unauthenticated mass-exploitable, and vendor-released fixed builds eliminate exposure.
An external control of file name or path flaw in the Synology DiskStation Manager (DSM) Upload API allows remote authenticated users to write files to arbitrary locations on the appliance, which can be leveraged for data integrity tampering and denial-of-service against the NAS. The defect is reachable over the network with low attack complexity and no user interaction, but it requires a valid DSM account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, base 8.1 High), so practical exposure is concentrated on low-privilege or compromised accounts and on DSM instances whose login interface faces untrusted networks. Affected builds are DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation. The dual integrity-and-availability impact, with no confidentiality effect, is what drives the High severity rating.
Authenticated remote attackers holding low-privileged credentials can exploit an incorrect permission assignment in the LDAP API of Synology DiskStation Manager to read or write arbitrary files and to trigger denial-of-service conditions, giving full loss of confidentiality, integrity, and availability on affected systems per the assessed vector (CVSS 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The vulnerability affects DSM builds before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075, with realistic exposure concentrated in NAS deployments that expose the management interface and run directory-services/LDAP functionality. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and the authentication requirement plus the need for a network-reachable DSM instance are the primary factors limiting real-world abuse.
Synology DiskStation Manager (DSM) login logic uses insufficiently random values, letting remote unauthenticated attackers (CVSS PR:N) read or write arbitrary files and mount denial-of-service attacks on NAS devices running DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075. Synology rates the flaw 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), while independent assessment keeps the same impact but raises attack complexity to High, since the attacker must successfully predict or reproduce the weakly-random login value, potentially requiring repeated attempts or offline computation. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but the unaudited attack surface (DSM's web login on typical management ports) and full CIA impact make prompt patching the priority for any internet-reachable instance.
Improper output encoding in the SCGI service of Synology DiskStation Manager (DSM) lets unauthenticated remote attackers read or write arbitrary files on the appliance and mount denial-of-service attacks against it. Every DSM build prior to 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, or 7.4-90075 is affected, and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, 9.8) confirms no credentials, user interaction, or non-default settings are needed - the only real precondition is network reachability to the SCGI interface, which makes internet-facing NAS units the highest-risk deployments while firewall/VPN-isolated devices carry substantially lower risk. No public exploit code has been identified at the time of analysis and the issue is not in CISA KEV, but the combination of full confidentiality, integrity, and availability impact with no authentication requirement makes rapid patching a priority.
Stored/reflected cross-site scripting in Synology Chat Server before 2.4.5-22148 lets a remote authenticated user who lures a victim into a UI interaction execute injected script that pivots into the underlying DSM platform to read or write arbitrary files and trigger denial-of-service. The vendor-assigned CVSS 9.0 reflects a scope change (S:C) where compromise of the chat add-on cascades into the host DiskStation Manager operating system. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Incorrect default permissions in Synology Assistant before version 7.0.7-50095 expose locally created installation artifacts to unauthorized access, enabling low-privileged local users to read or write arbitrary files and trigger denial-of-service conditions during the installation window. The CVSS score of 7.3 (High) with C:H/I:H/A:H reflects the breadth of potential file system impact, though an EPSS of 0.13% (3rd percentile) and SSVC exploitation status of 'none' confirm no public exploitation activity at time of analysis. A vendor-released patch exists at version 7.0.7-50095, and no public exploit code has been identified.
Synology OpenClaw versions 2026.2.22 and 2026.2.23 contain an authorization bypass in the synology-chat channel plugin where misconfigured allowlist policies with empty user IDs fail open, allowing authenticated Synology senders to dispatch unauthorized agents and execute downstream tool actions. The vulnerability requires network access and low-complexity exploitation, with a patch currently available.
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) was mishandled in the development of some or all operating-system kernels,. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
Command injection vulnerability in smart.cgi in Synology DiskStation Manager (DSM) before 5.2-5967-5 allows remote authenticated users to execute arbitrary commands via disk field. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 62.4%.
webman/imageSelector.cgi in Synology DiskStation Manager (DSM) 4.0 before 4.0-2259, 4.2 before 4.2-3243, and 4.3 before 4.3-3810 Update 1 allows remote attackers to append data to arbitrary files,. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 83.3%.
Unauthenticated senders can temporarily disable OpenClaw's Synology Chat webhook integration by exhausting a shared invalid-token rate-limit budget on versions 2026.3.25 through 2026.8.1. Because the limiter is applied before authentication and keyed on the raw proxy socket address, any deployment where OpenClaw sits behind a reverse proxy or tunnel causes all external clients to share one counter, so junk webhook calls from a single source can cause legitimate Synology Chat callbacks to be rejected until the rate-limit window resets. The attacker gains no token and no message data - this is a scoped, temporary availability loss (CVSS 4.0 base 6.9, AV:N/PR:N/VA:L) with no public exploit identified at time of analysis, and it is assessed as a genuinely low-priority DoS issue; the vendor-released fix is 2026.8.1.
Information disclosure in Synology DiskStation Manager (DSM) lets unauthenticated remote attackers read a limited set of files by overwhelming the built-in Auto Block brute-force protection with sustained authentication attempts. The root cause is an improper restriction of excessive authentication attempts (CWE-307), and exploitation is technically difficult (CVSS 3.7, AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) with the payoff confined to low-confidentiality reads and no write or denial-of-service capability. Affected versions are DSM before 7.2.1-69057-10, 7.2.2-72806-7, and 7.3.2-86009-2; no public exploit identified at time of analysis, and this remains a low-priority finding despite being remotely reachable and unauthenticated.
Unauthenticated path traversal in the Synology DiskStation Manager (DSM) Desktop API allows remote attackers to write a limited set of files and cause a limited denial-of-service condition on DSM instances older than 7.2.1-69057-10, 7.2.2-72806-7, or 7.3.2-86009-2. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, exploitation requires only network reachability to the DSM web management interface - no credentials or user interaction - though the impact is deliberately bounded: there is no confidentiality loss (C:N), with only low integrity and low availability effects from constrained file writes and partial service disruption. No public exploit code or confirmed in-the-wild exploitation has been identified at time of analysis, and an EPSS score was not available in the supplied intelligence.
Unauthenticated remote attackers can query the Desktop API in Synology DiskStation Manager (DSM) to retrieve non-sensitive information, affecting DSM versions before 7.2.1-69057-10, 7.2.2-72806-7, and 7.3.2-86009-2. The CVSS 3.1 score is 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), and while no public exploit code or active exploitation has been identified at time of analysis, the flaw still offers reconnaissance value because no authentication or user interaction is required. Given the limited confidentiality impact and lack of integrity or availability effects, this is a low-priority issue, with risk primarily determined by whether the DSM management interface is internet-facing.
Server-side request forgery in the PersonMail API of Synology DiskStation Manager (DSM) allows an authenticated low-privilege user to coerce the appliance into making arbitrary requests, potentially retrieving non-sensitive information from internal or external endpoints. The flaw affects DSM versions before 7.2.1-69057-10, 7.2.2-72806-7, and 7.3.2-86009-2, and carries a CVSS 3.1 score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). No public exploit code or active exploitation has been identified at time of analysis, and the vendor rates the confidentiality impact as limited to non-sensitive data with no integrity or availability effect.
Path traversal in the Audio API of Synology DiskStation Manager (DSM) allows remote authenticated users to read files outside the intended directory, though the vendor explicitly scopes the exposed content as non-sensitive information. Affected are DSM installations before 7.2.1-69057-10, before 7.2.2-72806-7, and before 7.3.2-86009-2; the flaw is network-reachable (AV:N) but requires a valid DSM account (PR:L) and needs no user interaction, and it carries no write or availability impact (CVSS 3.1 base 4.3). There is no public exploit identified at time of analysis, and the combination of the authentication prerequisite with the non-sensitive nature of the disclosed data keeps realistic risk low.
Cross-site scripting in the Video API of Synology DiskStation Manager (DSM) allows a remote authenticated user to read or write a limited set of files in the context of a victim's browser session when the video player is launched. Affected builds are DSM before 7.2.1-69057-10, 7.2.2-72806-7, and 7.3.2-86009-2; exploitation requires a valid DSM account with Video API access plus victim interaction (launching the player), and impact is bounded to low-confidentiality and low-integrity file access rather than code execution. No public exploit code or confirmed active exploitation is identified in the available data, and the CVSS 5.4 / EPSS-consistent profile places this as routine-priority patching.
Information disclosure in Synology DiskStation Manager (DSM) allows remote authenticated users to obtain sensitive information by directly requesting the Wallpaper Path resource, bypassing intended navigation controls. Affected versions are DSM before 7.2.1-69057-10, 7.2.2-72806-7, and 7.3.2-86009-2. Exploitation requires a valid DSM account (PR:L) and network access to the DSM web interface; no public exploit identified at time of analysis. Vendor patches are available in the listed fixed builds.
Integer overflow in the File Operation component of Synology DiskStation Manager (DSM) allows remote authenticated users to trigger a limited denial-of-service condition against affected NAS appliances. Only systems running DSM versions prior to 7.2.1-69057-10, 7.2.2-72806-7, or 7.3.2-86009-2 are affected; the vulnerability requires a valid DSM account with rights to invoke File Operation, matching the CVSS vector's PR:L (authenticated) rating. Impact is confined to low availability loss with no confidentiality or integrity effect, no public exploit code has been identified at time of analysis, and EPSS/KEV data do not indicate active exploitation, making this a low-priority issue despite the network attack vector.
An authenticated SQL injection in the Sharing API of Synology DiskStation Manager (DSM) allows remote users with valid - even low-privilege - DSM credentials to read arbitrary sharing files they should not be able to access. The flaw (CWE-89) affects DSM builds prior to 7.2.1-69057-10, 7.2.2-72806-7, and 7.3.2-86009-2, and is constrained by its credential prerequisite: no user interaction is required, but a logged-in session is, which limits it to a confidentiality-only impact (CVSS 6.5, C:H/I:N/A:N) rather than full system compromise. At time of analysis there is no CISA KEV listing and no public exploit code identified, so the practical risk is a bounded data-disclosure issue for organizations that expose the DSM Sharing API to untrusted or broad authenticated user populations.
A SQL injection vulnerability in the EventScheduler API of Synology DiskStation Manager (DSM) allows an authenticated remote attacker with administrator privileges to retrieve non-sensitive information from the underlying database. Affected versions include DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075. The CVSS score of 2.7 (Low) accurately reflects the limited impact, and no public exploit has been identified at time of analysis. The primary limiting factor is the requirement for high-privileged (admin) access to the DSM management interface.
Cross-site scripting in the Synology DiskStation Manager (DSM) Theme API lets a remote attacker who already holds DSM administrator privileges inject script that executes in another DSM user's authenticated session, enabling limited file read and write through that session. Exploitation requires the privileged attacker to inject the payload and a separate victim to interact with the affected web page (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N, base score 4.8); the scope change reflects that the injected script can act outside the attacker's own session, but the confidentiality and integrity impact remain limited. Only DSM builds prior to 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 are affected, and there is no public exploit identified at time of analysis. This is a low-priority, defense-in-depth issue rather than an urgent one, since the attacker must already be an administrator before the flaw grants anything.
Improper neutralization of CRLF sequences in the Sharing API of Synology DiskStation Manager (DSM) allows remote authenticated users to write limited files on the appliance when a victim clicks an attacker-crafted sharing URL. The issue affects DSM builds prior to 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075, and is scored CVSS 3.1 3.5 (AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) - a low-priority rating the vector fairly reflects, since exploitation requires both a valid low-privileged DSM account and a victim's click-through, and yields only a low integrity impact with no confidentiality or availability loss. No public exploit identified at time of analysis, and the flaw is not listed as confirmed actively exploited (CISA KEV).
Improper encoding and escaping of output in the Auth API of Synology DiskStation Manager (DSM) lets remote, unauthenticated attackers retrieve information the vendor classifies as non-sensitive, affecting deployments before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, 5.3) confirms exploitation needs no credentials, no user interaction, and no non-default configuration, so the only meaningful barrier is impact rather than access. There is no public exploit identified at time of analysis and no KEV listing, and because disclosure is limited to non-sensitive information, the practical value to an attacker is reconnaissance and fingerprinting rather than direct compromise; vendor-released patches exist in the fixed DSM builds published under Synology advisory SA_26_13.
Cross-site scripting in Synology Chat Server's extract domain feature allows authenticated remote users to inject malicious scripts that execute upon victim UI interaction, with impact extending beyond the Chat application into the broader DSM (DiskStation Manager) environment. The scope change captured in the CVSS vector (S:C) is the key risk amplifier: successful exploitation can result in reading or writing restricted DSM files and conducting limited denial-of-service against DSM. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available.
Server-Side Request Forgery in Synology Chat Server's webhook functionality allows remote authenticated users to probe internal or external network resources and retrieve non-sensitive information. Affected versions are all Chat Server releases prior to 2.4.5-22148. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog; however, the authenticated network attack vector and low complexity make this straightforward to exploit for any valid user of the application.
An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in Backup Task functionality in Synology Hyper Backup before 4.1.2-4036 allows remote authenticated. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.
An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in Backup.Repository webapi component in Synology Hyper Backup before 4.1.2-4036 allows remote. Rated medium severity (CVSS 4.1), this vulnerability is remotely exploitable, low attack complexity.
A cleartext transmission of sensitive information vulnerability in Synology Note Station Client before 2.2.4-703 allows man-in-the-middle attackers to obtain user credential. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required.
An inclusion of functionality from untrusted control sphere vulnerability in MinGW DLL component in Synology Hyper Backup Explorer before 3.0.1-0156 allows local users to execute arbitrary code via. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
An inclusion of functionality from untrusted control sphere vulnerability in OpenSSL configuration in Synology Active Backup for Business Recovery Media Creator before 2.5.0-2081 allows local users. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
Volume encryption in Synology Storage Manager before version 1.0.1-1100 transmits sensitive data via HTTP GET query strings, exposing encryption-related secrets to local attackers who can access web server logs, browser history, or other locally readable URL artifacts. The flaw (CWE-598) requires no privileges or user interaction beyond local system presence, and carries a High confidentiality impact rating because credentials or passphrases associated with volume encryption may be recoverable from logged GET requests. No public exploit exists and EPSS sits at the 1st percentile, indicating no widespread exploitation activity at time of analysis.
Synology Assistant before version 7.0.6-50085 exposes local users to arbitrary file write with restricted content via an origin validation error triggered during the installation process. The CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H) indicates that while integrity impact is limited, availability impact is rated High - meaning an attacker can corrupt or overwrite files in ways that destabilize the system, even though the written content is constrained. No public exploit code exists and CISA has not added this to KEV; EPSS stands at 0.00%, reflecting minimal observed exploitation interest.
Synology Active Backup for Business Agent before version 3.1.0-4967 contains an origin validation error (CWE-346) that permits local users to write arbitrary files with restricted content during the installation process, resulting in high availability impact and limited integrity compromise. The CVSS vector (AV:L/PR:N/UI:R) indicates exploitation requires local system access and user interaction - specifically, the installation must be in progress. No public exploit code has been identified and EPSS sits at 0.00%, aligning with SSVC's 'exploitation: none' assessment, indicating this is a low-urgency but legitimate local privilege abuse risk during deployment windows.
Arbitrary file disclosure in Synology Active Backup for Business (DSM add-on package, versions before 2.7.1-3234) lets unauthenticated remote attackers read sensitive files on the host via a SQL injection flaw (CWE-89). The vulnerability scores CVSS 8.6 with a changed scope and high confidentiality impact, but EPSS estimates only a 0.04% (14th percentile) exploitation probability, and there is no public exploit identified at time of analysis nor any CISA KEV listing. Synology, who self-reported the issue, has released a fixed package.
Credential disclosure in Synology C2 Identity Edge Server (DSM versions before 1.76.0-0307) allows remote unauthenticated attackers to retrieve user credentials directly from the edge server over the network. The flaw stems from an exposed dangerous method/function (CWE-749) reachable without authentication, yielding a high-confidentiality impact with no integrity or availability effect. No public exploit has been identified at time of analysis, and EPSS scores it at the bottom 7th percentile, indicating low near-term exploitation likelihood despite the network-reachable vector.
Arbitrary file write with restricted content in Synology ActiveProtect Agent before 1.1.0-0439 is exploitable by local users during the installation process due to an origin validation error (CWE-346). The CVSS vector (AV:L/AC:L/PR:N/UI:R) indicates a low-complexity local attack requiring user interaction - consistent with exploitation during an installation workflow - and scores high on availability impact (A:H) while integrity impact is limited (I:L), suggesting the file write can disrupt system stability despite content restrictions. No public exploit code exists and CISA SSVC rates exploitation as none with partial technical impact.
Authentication bypass in the SSO component of Synology DiskStation Manager (DSM) allows remote, unauthenticated attackers to impersonate a user by supplying a distinguished name (DN) they already know, letting them skip normal credential verification entirely. Affected releases are DSM 7.2.2 before 7.2.2-72806-5 and DSM 7.3 before 7.3.1-86003-1; DSM 7.2.1-69057 is explicitly not affected, and the feature must be configured/enabled for a device to be exposed. There is no public exploit identified at time of analysis and EPSS is low (0.05%, 17th percentile), but exploitation is not automatable because the attacker needs prior knowledge of a valid DN, which is the main brake on mass scanning; CISA SSVC rates technical impact as total for a successfully targeted unit.
Cross-site scripting in Synology Contacts before version 1.0.10-20659 allows authenticated remote users to read or write specific files containing non-sensitive information by injecting malicious input through the contact functionality. The CVSS scope change (S:C) confirms the injected script executes in a context beyond the originating application, affecting any victim who views the crafted contact entry. No public exploit identified at time of analysis, and CISA has not listed this in the Known Exploited Vulnerabilities catalog.
Remote code execution in Synology BeeStation OS versions before 1.3.2-65648 stems from a classic buffer overflow in the AdminCenter component, the device's web-based management interface. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates a network-reachable flaw exploitable by unauthenticated attackers with low complexity and no user interaction, yielding full compromise of confidentiality, integrity, and availability (9.8 Critical). There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the unauthenticated network-RCE profile on a consumer NAS device makes this a high-priority patch target.
Stored XSS in Synology Safe Access before 1.3.1-0329 on SRM (Synology Router Manager) allows remote authenticated administrators to inject malicious scripts that execute in the SRM context, enabling limited reads or writes of non-sensitive files and constrained denial-of-service conditions. The CVSS Scope:Changed rating confirms cross-component impact - the vulnerability originates in the Safe Access module but affects the broader SRM platform. No public exploit code exists and no active exploitation has been identified; EPSS at 0.03% and SSVC exploitation status of 'none' collectively indicate negligible current threat in the wild.
Incorrect authorization vulnerability in IO Module functionality in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 allows remote authenticated users with administrator privileges to. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity.
Insufficiently protected credentials vulnerability in IPSpeaker component in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 allows remote authenticated users with administrator. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity.
Improper preservation of permissions vulnerability in Archiving Push functionality in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 allows remote authenticated users with. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity.
Cleartext transmission of sensitive information vulnerability in Export Key functionality in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 allows remote authenticated users with. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity.
Missing authorization vulnerability in AddOns functionality in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 allows remote authenticated users with administrator privileges to. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity.
Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in Archiving Pull functionality in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 allows. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity.
Files or directories accessible to external parties vulnerability in redis-server component in Synology BeeDrive for desktop before 1.3.2-13814 allows local users to conduct denial-of-service attacks. Rated medium severity (CVSS 6.8), this vulnerability is no authentication required, low attack complexity.
Uncontrolled search path element vulnerability in OpenSSL DLL component in Synology BeeDrive for desktop before 1.3.2-13814 allows local users to execute arbitrary code via unspecified vectors. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
OpenClaw before 2026.4.22 allows workspace dotenv files to override connector endpoint hosts for Matrix, Mattermost, IRC, and Synology connectors, enabling local attackers with workspace access to redirect runtime traffic to malicious endpoints. The vulnerability requires local access and user interaction but allows high confidentiality impact through traffic interception. No active exploitation has been identified, but a vendor-released patch is available.
A plaintext storage of a password vulnerability in Synology SSL VPN Client before 1.4.5-0684 allows remote attackers to access or influence the user's PIN code due to insecure storage. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A files or directories accessible to external parties vulnerability in Synology SSL VPN Client before 1.4.5-0684 allows remote attackers to access files within the installation directory via a local. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
OpenClaw before 2026.3.22 contains a webhook path route replacement vulnerability in its Synology Chat extension that allows unauthenticated remote attackers to bypass per-account direct message access controls by collapsing multi-account configurations onto shared webhook paths. Attackers can exploit inherited or duplicate webhook paths to replace route ownership across accounts, potentially gaining unauthorized access to account-specific resources. No public exploit code or active exploitation has been confirmed at the time of analysis.
Synology OpenClaw versions prior to 2026.2.24 contain an authorization bypass in the synology-chat channel plugin where misconfigured allowlist policies with empty user IDs fail to enforce access controls. Authenticated attackers with Synology sender privileges can exploit this flaw to send unauthorized messages through downstream agents and tools. A patch is available.
Synology Presto Client versions prior to 2.1.3-0672 are vulnerable to DLL hijacking during installation, enabling local attackers with user privileges to read or write arbitrary files by placing malicious libraries in the installer directory. The vulnerability requires user interaction and local access but grants high-impact capabilities including confidentiality and integrity violations. No patch is currently available.
Origin validation error vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.3-13973 allows local users to write arbitrary files with non-sensitive information via unspecified vectors.
Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.2-13960 allows local users to execute arbitrary code via unspecified vectors.
Missing authorization vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.2-13960 allows remote attackers to delete arbitrary files via unspecified vectors.
Missing authentication for critical function vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.2-13960 allows local users to execute arbitrary code via unspecified vectors.
A vulnerability in Synology Mail Server allows remote authenticated attackers to read and write non-sensitive settings, and disable some non-critical functions.
A vulnerability in portenable cgi allows remote authenticated users to get the status of installed packages.
A vulnerability in VideoPlayer2 subtitle cgi allows remote authenticated users to read .srt files.
A vulnerability in FileStation file cgi allows remote authenticated users to read file metadata and path information.
A vulnerability in FileStation thumb cgi allows remote authenticated users to read/write image files.
Improper control of dynamically-managed code resources vulnerability in WebAPI component in Synology DiskStation Manager (DSM) before 7.1.1-42962-8 and 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote authenticated users to obtain privileges without consent via unspecified vectors.
Out-of-bounds write vulnerability in cgi components in Synology DiskStation Manager (DSM) before 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote attackers to conduct denial-of-service attacks via unspecified vectors.
Cross-Site Request Forgery (CSRF) vulnerability in WebAPI Framework in Synology DiskStation Manager (DSM) before 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote attackers to execute arbitrary code via unspecified vectors.
Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Synology RADIUS Server allows remote authenticated users with administrator privileges to read or. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
CVE-2025-29885 is an improper certificate validation vulnerability in Synology File Station 5 that allows authenticated remote attackers to compromise system confidentiality, integrity, and availability. The vulnerability affects File Station 5 versions prior to 5.5.6.4791 and requires valid user credentials to exploit. With a CVSS score of 8.8 and a low attack complexity, this represents a significant risk to organizations running vulnerable versions, though exploitation requires prior authentication.
CVE-2025-29884 is an improper certificate validation vulnerability affecting Synology File Station 5 that allows authenticated remote attackers to compromise system confidentiality, integrity, and availability. The vulnerability requires user-level access but enables complete system compromise with high impact across all security dimensions. No active KEV or public POC data is currently available, but the CVSS 8.8 score and low attack complexity indicate this should be prioritized for patching.
Denial-of-service vulnerability in QNAP File Station 5 that allows an authenticated attacker to exhaust system resources without limits or throttling, preventing legitimate users and processes from accessing the affected service. The vulnerability affects File Station 5 versions prior to 5.5.6.4847 and is remotely exploitable with no user interaction required once account access is obtained. With a CVSS score of 7.5 (High) and network-based attack vector, this represents a significant availability risk for organizations relying on File Station for network file access.
A vulnerability in Synology Active Backup for Microsoft 365 allows remote authenticated attackers to obtain sensitive information via unspecified vectors. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Missing authorization vulnerability in synocopy in Synology DiskStation Manager (DSM) before 7.1.1-42962-8, 7.2.1-69057-7 and 7.2.2-72806-3 allows remote attackers to read arbitrary files via. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in the system syncing daemon in Synology Drive Server before 3.0.4-12699, 3.2.1-23280, 3.5.0-26085. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing authentication for critical function vulnerability in the webapi component in Synology Drive Server before 3.0.4-12699, 3.2.1-23280, 3.5.0-26085 and 3.5.1-26102 allows remote attackers to. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper encoding or escaping of output vulnerability in the webapi component in Synology BeeStation OS (BSM) before 1.1-65374 and Synology DiskStation Manager (DSM) before 7.1.1-42962-7,. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability regarding out-of-bounds read is found in the video interface. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Off-by-one error vulnerability in the transmission component in Synology Replication Service before 1.0.12-0066, 1.2.2-0353 and 1.3.0-0423 and Synology Unified Controller (DSMUC) before 3.1.4-23079. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper certificate validation vulnerability in the update functionality in Synology BeeStation OS (BSM) before 1.1-65374 and Synology DiskStation Manager (DSM) before 6.2.4-25556-8, 7.1.1-42962-7,. Rated medium severity (CVSS 4.3), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Improper certificate validation vulnerability in the LDAP utilities in Synology DiskStation Manager (DSM) before 7.1.1-42962-8, 7.2.1-69057-7 and 7.2.2-72806-3 allows man-in-the-middle attackers to. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Improper encoding or escaping of output vulnerability in the system plugin daemon in Synology BeeStation OS (BSM) before 1.1-65374 and Synology DiskStation Manager (DSM) before 7.2-64570-4,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in share file list functionality in Synology Active Backup for Business before 2.7.1-13234, 2.7.1-23234. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in encrypted share umount functionality in Synology Active Backup for Business before 2.7.1-13234,. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in agent-related functionality in Synology Active Backup for Business before 2.7.1-13234, 2.7.1-23234 and. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Authorization bypass through user-controlled key vulnerability in streaming service in Synology Media Server before 1.4-2680, 2.0.5-3152 and 2.2.0-3325 allows remote attackers to read specific files. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in DDNS Record functionality in Synology Router Manager (SRM) before 1.3.1-9346-10 allows remote. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.