DM
Product
Diskstation Manager
On CISA KEVExploited in the wild
96
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 18High 45Medium 25Low 2
Watch
Add Diskstation Manager to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-3156 In wildKEV | 7.8 | Jan 26 | Sudo Heap-Based Buffer Overflow Vulnerability Affected: 6.2 |
| CVE-2024-5401 | 8.8 | Dec 4 | Improper control of dynamically-managed code resources vulnerability in WebAPI component in Synology DiskStation Manager (DSM) before 7.1.1-42962-8 and 7.2.1-69057-2 and… Affected: 7.2.1-69057 before 7.2.1-69057-2; 7.2.2-72803 before 7.2.2-72806 |
| CVE-2022-22684 | 8.8 | Jul 28 | Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in task management component in Synology DiskStation Manager (DSM) before… Affected: before 6.2.4-25553 |
| CVE-2022-22688 | 8.8 | Mar 25 | Improper neutralization of special elements used in a command ('Command Injection') vulnerability in File service functionality in Synology DiskStation Manager (DSM) before… Affected: 7.0 before 7.0.1-42214 |
| CVE-2021-44142 | 8.8 | Feb 21 | The Samba vfs_fruit module uses extended file attributes (EA, xattr) to provide "...enhanced compatibility with Apple SMB clients and interoperability with a Netatalk 3 AFP… Affected: 6.2 before 6.2.4-25556.4 |
| CVE-2021-31439 | 8.8 | May 21 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Synology DiskStation Manager Affected: 6.2 before 6.2.3-25426-3 |
| CVE-2018-13284 | 8.8 | Apr 1 | Command injection vulnerability in ftpd in Synology Diskstation Manager (DSM) before 6.2-23739-1 allows remote authenticated users to execute arbitrary OS commands via the (1) MKD… Affected: 5.2 before 5.2-5967-8; 6.0 before 6.0.3-8754-8; 6.1 before 6.1.7-15284-1; 6.2 before 6.2-23739-1 |
| CVE-2018-8916 | 8.8 | Jun 8 | Unverified password change vulnerability in Change Password in Synology DiskStation Manager (DSM) before 6.2-23739 allows remote authenticated users to reset password without… Affected: before 6.2-23739 |
| CVE-2017-15889 | 8.8 | Dec 4 | Command injection vulnerability in smart.cgi in Synology DiskStation Manager (DSM) before 5.2-5967-5 allows remote authenticated users to execute arbitrary commands via disk field Affected: before 5.2-5967-5 |
| CVE-2021-26564 | 8.7 | Feb 26 | Cleartext transmission of sensitive information vulnerability in synorelayd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-the-middle attackers to spoof… Affected: before 6.2.3-25426-3 |
| CVE-2020-27653 | 8.3 | Oct 29 | Algorithm downgrade vulnerability in QuickConnect in Synology Router Manager (SRM) before 1.2.4-8081 allows man-in-the-middle attackers to spoof servers and obtain sensitive… Affected: 6.2.3_25426 |
| CVE-2020-27652 | 8.3 | Oct 29 | Algorithm downgrade vulnerability in QuickConnect in Synology DiskStation Manager (DSM) before 6.2.3-25426-2 allows man-in-the-middle attackers to spoof servers and obtain… Affected: 6.2 before 6.2.3-25426-2 |
| CVE-2023-0142 | 8.1 | Jun 13 | Uncontrolled search path element vulnerability in Backup Management functionality in Synology DiskStation Manager (DSM) before 6.2.4-25556-8, 7.0.1-42218-7 and 7.1-42661 allows… Affected: 6.2 before 7.1-42661 |
| CVE-2022-27626 | 8.1 | Oct 20 | A vulnerability regarding concurrent execution using shared resource with improper synchronization ('Race Condition') is found in the session processing functionality of… Affected: before 7.1.1-42962-2 |
| CVE-2022-27610 | 8.1 | Jul 27 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology DiskStation Manager (DSM) before 6.2.3-25423 allows… Affected: 6.2 before 6.2.3-25423 |
| CVE-2021-26569 | 8.1 | Mar 12 | Race Condition within a Thread vulnerability in iscsi_snapshot_comm_core in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to execute arbitrary… Affected: before 6.2.3-25426-3 |
| CVE-2021-26562 | 8.1 | Feb 26 | Out-of-bounds write vulnerability in synoagentregisterd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-the-middle attackers to execute arbitrary code via… Affected: before 6.2.3-25426-3 |
| CVE-2021-26561 | 8.1 | Feb 26 | Stack-based buffer overflow vulnerability in synoagentregisterd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-the-middle attackers to execute arbitrary… Affected: before 6.2.3-25426-3 |
| CVE-2021-29088 | 7.8 | Jun 1 | Improper limitation of a pathname to a restricted directory ('Path Traversal') in cgi component in Synology DiskStation Manager (DSM) before 6.2.4-25553 allows local users to… Affected: before 6.2.4-25553 |
| CVE-2021-26567 | 7.8 | Feb 26 | Stack-based buffer overflow vulnerability in frontend/main.c in faad2 before 2.2.7.1 allow local attackers to execute arbitrary code via filename and pathname options Affected: before 6.2.3-25426-3 |
| CVE-2018-8897 | 7.8 | May 8 | A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) was mishandled in the development of some or all… Affected: 5.2; 6.0; 6.1 |
| CVE-2024-45539 | 7.5 | Dec 4 | Out-of-bounds write vulnerability in cgi components in Synology DiskStation Manager (DSM) before 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller (DSMUC) before… Affected: 7.2.1-69057 before 7.2.1-69057-2; 7.2.2-72803 before 7.2.2-72806 |
| CVE-2025-1021 | 7.5 | Apr 23 | Missing authorization vulnerability in synocopy in Synology DiskStation Manager (DSM) before 7.1.1-42962-8, 7.2.1-69057-7 and 7.2.2-72806-3 allows remote attackers to read… Affected: 7.1 before 7.1.1-42962-8; 7.2.1-69057 before 7.2.1-69057-7; 7.2.2 before 7.2.2-72806-3 |
| CVE-2024-10444 | 7.5 | Mar 19 | Improper certificate validation vulnerability in the LDAP utilities in Synology DiskStation Manager (DSM) before 7.1.1-42962-8, 7.2.1-69057-7 and 7.2.2-72806-3 allows… Affected: 7.1 before 7.1.1-42962-8; 7.2.1-69057 before 7.2.1-69057-7; 7.2.2 before 7.2.2-72806-3 |
| CVE-2023-2729 | 7.5 | Jun 13 | Use of insufficiently random values vulnerability in User Management Functionality in Synology DiskStation Manager (DSM) before 7.2-64561 allows remote attackers to obtain user… Affected: 6.2 before 7.2-64561 |
| CVE-2022-3576 | 7.5 | Oct 20 | A vulnerability regarding out-of-bounds read is found in the session processing functionality of Out-of-Band (OOB) Management Affected: before 7.1.1-42962-2 |
| CVE-2022-22680 | 7.5 | Feb 7 | Exposure of sensitive information to an unauthorized actor vulnerability in Web Server in Synology DiskStation Manager (DSM) before 7.0.1-42218-2 allows remote attackers to obtain… Affected: 6.2 before 6.2.4-25556-3; 7.0 before 7.0.1-42218-2 |
| CVE-2021-29087 | 7.5 | Jun 23 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows… Affected: 6.2 before 6.2.3-25426-3 |
| CVE-2021-29086 | 7.5 | Jun 23 | Exposure of sensitive information to an unauthorized actor vulnerability in webapi component in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to… Affected: 6.2 before 6.2.3-25426-3 |
| CVE-2021-29085 | 7.5 | Jun 23 | Improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in file sharing management component in Synology DiskStation… Affected: 6.2 before 6.2.3-25426-3 |
| CVE-2021-29084 | 7.5 | Jun 23 | Improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in Security Advisor report management component in Synology… Affected: 6.2 before 6.2.3-25426-3 |
| CVE-2019-9518 | 7.5 | Aug 13 | Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service Affected: 6.2 |
| CVE-2019-9517 | 7.5 | Aug 13 | Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service Affected: 6.2 |
| CVE-2019-9515 | 7.5 | Aug 13 | Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service Affected: 6.2 |
| CVE-2019-9514 | 7.5 | Aug 13 | Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service Affected: 6.2 |
| CVE-2019-9513 | 7.5 | Aug 13 | Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service Affected: 6.2 |
| CVE-2019-9511 | 7.5 | Aug 13 | Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service Affected: 6.2 |
| CVE-2018-7185 | 7.5 | Mar 6 | The protocol engine in ntp 4.2.6 before 4.2.8p11 allows a remote attackers to cause a denial of service (disruption) by continually sending a packet with a zero-origin timestamp… Affected: 5.2 before 6.1.6-15266 |
| CVE-2018-7184 | 7.5 | Mar 6 | ntpd in ntp 4.2.8p4 before 4.2.8p11 drops bad packets before updating the "received" timestamp, which allows remote attackers to cause a denial of service (disruption) by sending… Affected: 5.2; 6.0; 6.1 |
| CVE-2017-9553 | 7.5 | Jul 24 | A design flaw in SYNO.API.Encryption in Synology DiskStation Manager (DSM) before 6.1.3-15152 allows remote attackers to bypass the encryption protection mechanism via the crafted… Affected: through 6.1.1-15101-4 |
| CVE-2021-26560 | 7.4 | Feb 26 | Cleartext transmission of sensitive information vulnerability in synoagentregisterd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-the-middle attackers… Affected: before 6.2.3-25426-3 |
| CVE-2022-27616 | 7.2 | Aug 3 | Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in webapi component in Synology DiskStation Manager (DSM) before… Affected: 6.2 before 6.2.4-25556-5; 7.0 before 7.0.1-42218-3 |
| CVE-2021-29083 | 7.2 | Apr 1 | Improper neutralization of special elements used in an OS command in SYNO.Core.Network.PPPoE in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote authenticated… Affected: before 6.2.3-25426-3 |
| CVE-2018-8920 | 7.2 | Dec 24 | Improper neutralization of escape vulnerability in Log Exporter in Synology DiskStation Manager (DSM) before 6.1.6-15266 allows remote attackers to inject arbitrary content to… Affected: before 6.1.6-15266 |
| CVE-2017-12075 | 7.2 | Jun 8 | Command injection vulnerability in EZ-Internet in Synology DiskStation Manager (DSM) before 6.2-23739 allows remote authenticated users to execute arbitrary command via the… Affected: before 6.2-23739 |
Showing 45