DM
Product
Diskstation Manager
On CISA KEVExploited in the wild
96
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 18High 45Medium 25Low 2
Watch
Add Diskstation Manager to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-3156 In wildKEV | 7.8 | Jan 26 | Sudo Heap-Based Buffer Overflow Vulnerability Affected: 6.2 |
| CVE-2025-13392 | 9.8 | May 27 | Improper check for unusual or exceptional conditions vulnerability in SSO in Synology DiskStation Manager (DSM) before 7.2.2-72806-5 and 7.3.1-86003-1 (7.2.1-69057 is not… Affected: 7.2.2 before 7.2.2-72806-5; 7.3 through 7.3.1-86003-1 |
| CVE-2024-10441 | 9.8 | Mar 19 | Improper encoding or escaping of output vulnerability in the system plugin daemon in Synology BeeStation OS (BSM) before 1.1-65374 and Synology DiskStation Manager (DSM) before… Affected: 7.2 before 7.2-64570-4; 7.2.1-69057 before 7.2.1-69057-6; 7.2.2 before 7.2.2-72806-1 |
| CVE-2022-27624 | 9.8 | Oct 20 | A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the packet decryption functionality of Out-of-Band (OOB) Management Affected: before 7.1.1-42962-2 |
| CVE-2022-27625 | 9.8 | Oct 20 | A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the message processing functionality of Out-of-Band (OOB) Management Affected: before 7.1.1-42962-2 |
| CVE-2022-22687 | 9.8 | Mar 25 | Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in Authentication functionality in Synology DiskStation Manager (DSM) before 6.2.3-25426-3… Affected: 6.2 before 6.2.3-25426-3 |
| CVE-2021-43927 | 9.8 | Feb 7 | Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Security Management functionality in Synology DiskStation Manager (DSM)… Affected: 6.2 before 6.2.4-25556-3; 7.0 before 7.0.1-42218-2 |
| CVE-2021-43926 | 9.8 | Feb 7 | Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Log Management functionality in Synology DiskStation Manager (DSM) before… Affected: 6.2 before 6.2.4-25556-3; 7.0 before 7.0.1-42218-2 |
| CVE-2021-43925 | 9.8 | Feb 7 | Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Log Management functionality in Synology DiskStation Manager (DSM) before… Affected: 6.2 before 6.2.4-25556-3; 7.0 before 7.0.1-42218-2 |
| CVE-2021-27649 | 9.8 | Jun 23 | Use after free vulnerability in file transfer protocol component in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via… Affected: 6.2 before 6.2.3-25426-3 |
| CVE-2021-27647 | 9.8 | Mar 12 | Out-of-bounds Read vulnerability in iscsi_snapshot_comm_core in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via… Affected: before 6.2.3-25426-3 |
| CVE-2021-27646 | 9.8 | Mar 12 | Use After Free vulnerability in iscsi_snapshot_comm_core in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via crafted… Affected: before 6.2.3-25426-3 |
| CVE-2018-8919 | 9.8 | Dec 24 | Information exposure vulnerability in SYNO.Core.Desktop.SessionData in Synology DiskStation Manager (DSM) before 6.1.6-15266 allows remote attackers to steal credentials via… Affected: before 6.1.6-15266 |
| CVE-2018-1160 | 9.8 | Dec 20 | Netatalk before 3.1.12 is vulnerable to an out of bounds write in dsi_opensess.c Affected: 5.2 before 5.2-5967-9; 6.1 before 6.1.7-15284-3; 6.2 before 6.2.1-23824-4 |
| CVE-2017-14491 | 9.8 | Oct 4 | Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response Affected: 5.2; 6.0; 6.1 |
| CVE-2024-45538 | 9.6 | Dec 4 | Cross-Site Request Forgery (CSRF) vulnerability in WebAPI Framework in Synology DiskStation Manager (DSM) before 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller… Affected: 7.2.1-69057 before 7.2.1-69057-2; 7.2.2-72803 before 7.2.2-72806 |
| CVE-2022-27623 | 9.1 | Oct 25 | Missing authentication for critical function vulnerability in iSCSI management functionality in Synology DiskStation Manager (DSM) before 7.1-42661 allows remote attackers to read… Affected: before 7.1-42661 |
| CVE-2021-26566 | 9.0 | Feb 26 | Insertion of sensitive information into sent data vulnerability in synorelayd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-the-middle attackers to… Affected: before 6.2.3-25426-3 |
| CVE-2020-27648 | 9.0 | Oct 29 | Improper certificate validation vulnerability in OpenVPN client in Synology DiskStation Manager (DSM) before 6.2.3-25426-2 allows man-in-the-middle attackers to spoof servers and… Affected: 6.2 before 6.2.3-25426-2 |
| CVE-2024-5401 | 8.8 | Dec 4 | Improper control of dynamically-managed code resources vulnerability in WebAPI component in Synology DiskStation Manager (DSM) before 7.1.1-42962-8 and 7.2.1-69057-2 and… Affected: 7.2.1-69057 before 7.2.1-69057-2; 7.2.2-72803 before 7.2.2-72806 |
| CVE-2022-22684 | 8.8 | Jul 28 | Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in task management component in Synology DiskStation Manager (DSM) before… Affected: before 6.2.4-25553 |
| CVE-2022-22688 | 8.8 | Mar 25 | Improper neutralization of special elements used in a command ('Command Injection') vulnerability in File service functionality in Synology DiskStation Manager (DSM) before… Affected: 7.0 before 7.0.1-42214 |
| CVE-2021-44142 | 8.8 | Feb 21 | The Samba vfs_fruit module uses extended file attributes (EA, xattr) to provide "...enhanced compatibility with Apple SMB clients and interoperability with a Netatalk 3 AFP… Affected: 6.2 before 6.2.4-25556.4 |
| CVE-2021-31439 | 8.8 | May 21 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Synology DiskStation Manager Affected: 6.2 before 6.2.3-25426-3 |
| CVE-2018-13284 | 8.8 | Apr 1 | Command injection vulnerability in ftpd in Synology Diskstation Manager (DSM) before 6.2-23739-1 allows remote authenticated users to execute arbitrary OS commands via the (1) MKD… Affected: 5.2 before 5.2-5967-8; 6.0 before 6.0.3-8754-8; 6.1 before 6.1.7-15284-1; 6.2 before 6.2-23739-1 |
| CVE-2018-8916 | 8.8 | Jun 8 | Unverified password change vulnerability in Change Password in Synology DiskStation Manager (DSM) before 6.2-23739 allows remote authenticated users to reset password without… Affected: before 6.2-23739 |
| CVE-2017-15889 | 8.8 | Dec 4 | Command injection vulnerability in smart.cgi in Synology DiskStation Manager (DSM) before 5.2-5967-5 allows remote authenticated users to execute arbitrary commands via disk field Affected: before 5.2-5967-5 |
| CVE-2021-26564 | 8.7 | Feb 26 | Cleartext transmission of sensitive information vulnerability in synorelayd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-the-middle attackers to spoof… Affected: before 6.2.3-25426-3 |
| CVE-2020-27653 | 8.3 | Oct 29 | Algorithm downgrade vulnerability in QuickConnect in Synology Router Manager (SRM) before 1.2.4-8081 allows man-in-the-middle attackers to spoof servers and obtain sensitive… Affected: 6.2.3_25426 |
| CVE-2020-27652 | 8.3 | Oct 29 | Algorithm downgrade vulnerability in QuickConnect in Synology DiskStation Manager (DSM) before 6.2.3-25426-2 allows man-in-the-middle attackers to spoof servers and obtain… Affected: 6.2 before 6.2.3-25426-2 |
| CVE-2023-0142 | 8.1 | Jun 13 | Uncontrolled search path element vulnerability in Backup Management functionality in Synology DiskStation Manager (DSM) before 6.2.4-25556-8, 7.0.1-42218-7 and 7.1-42661 allows… Affected: 6.2 before 7.1-42661 |
| CVE-2022-27626 | 8.1 | Oct 20 | A vulnerability regarding concurrent execution using shared resource with improper synchronization ('Race Condition') is found in the session processing functionality of… Affected: before 7.1.1-42962-2 |
| CVE-2022-27610 | 8.1 | Jul 27 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology DiskStation Manager (DSM) before 6.2.3-25423 allows… Affected: 6.2 before 6.2.3-25423 |
| CVE-2021-26569 | 8.1 | Mar 12 | Race Condition within a Thread vulnerability in iscsi_snapshot_comm_core in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to execute arbitrary… Affected: before 6.2.3-25426-3 |
| CVE-2021-26562 | 8.1 | Feb 26 | Out-of-bounds write vulnerability in synoagentregisterd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-the-middle attackers to execute arbitrary code via… Affected: before 6.2.3-25426-3 |
| CVE-2021-26561 | 8.1 | Feb 26 | Stack-based buffer overflow vulnerability in synoagentregisterd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-the-middle attackers to execute arbitrary… Affected: before 6.2.3-25426-3 |
| CVE-2021-29088 | 7.8 | Jun 1 | Improper limitation of a pathname to a restricted directory ('Path Traversal') in cgi component in Synology DiskStation Manager (DSM) before 6.2.4-25553 allows local users to… Affected: before 6.2.4-25553 |
| CVE-2021-26567 | 7.8 | Feb 26 | Stack-based buffer overflow vulnerability in frontend/main.c in faad2 before 2.2.7.1 allow local attackers to execute arbitrary code via filename and pathname options Affected: before 6.2.3-25426-3 |
| CVE-2018-8897 | 7.8 | May 8 | A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) was mishandled in the development of some or all… Affected: 5.2; 6.0; 6.1 |
| CVE-2024-45539 | 7.5 | Dec 4 | Out-of-bounds write vulnerability in cgi components in Synology DiskStation Manager (DSM) before 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller (DSMUC) before… Affected: 7.2.1-69057 before 7.2.1-69057-2; 7.2.2-72803 before 7.2.2-72806 |
| CVE-2025-1021 | 7.5 | Apr 23 | Missing authorization vulnerability in synocopy in Synology DiskStation Manager (DSM) before 7.1.1-42962-8, 7.2.1-69057-7 and 7.2.2-72806-3 allows remote attackers to read… Affected: 7.1 before 7.1.1-42962-8; 7.2.1-69057 before 7.2.1-69057-7; 7.2.2 before 7.2.2-72806-3 |
| CVE-2024-10444 | 7.5 | Mar 19 | Improper certificate validation vulnerability in the LDAP utilities in Synology DiskStation Manager (DSM) before 7.1.1-42962-8, 7.2.1-69057-7 and 7.2.2-72806-3 allows… Affected: 7.1 before 7.1.1-42962-8; 7.2.1-69057 before 7.2.1-69057-7; 7.2.2 before 7.2.2-72806-3 |
| CVE-2023-2729 | 7.5 | Jun 13 | Use of insufficiently random values vulnerability in User Management Functionality in Synology DiskStation Manager (DSM) before 7.2-64561 allows remote attackers to obtain user… Affected: 6.2 before 7.2-64561 |
| CVE-2022-3576 | 7.5 | Oct 20 | A vulnerability regarding out-of-bounds read is found in the session processing functionality of Out-of-Band (OOB) Management Affected: before 7.1.1-42962-2 |
| CVE-2022-22680 | 7.5 | Feb 7 | Exposure of sensitive information to an unauthorized actor vulnerability in Web Server in Synology DiskStation Manager (DSM) before 7.0.1-42218-2 allows remote attackers to obtain… Affected: 6.2 before 6.2.4-25556-3; 7.0 before 7.0.1-42218-2 |
| CVE-2021-29087 | 7.5 | Jun 23 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows… Affected: 6.2 before 6.2.3-25426-3 |
| CVE-2021-29086 | 7.5 | Jun 23 | Exposure of sensitive information to an unauthorized actor vulnerability in webapi component in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to… Affected: 6.2 before 6.2.3-25426-3 |
| CVE-2021-29085 | 7.5 | Jun 23 | Improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in file sharing management component in Synology DiskStation… Affected: 6.2 before 6.2.3-25426-3 |
| CVE-2021-29084 | 7.5 | Jun 23 | Improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in Security Advisor report management component in Synology… Affected: 6.2 before 6.2.3-25426-3 |
| CVE-2019-9518 | 7.5 | Aug 13 | Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service Affected: 6.2 |