Synology Diskstation Manager (Dsm)
72 CVEs affecting Synology Diskstation Manager (Dsm). Latest disclosed: 2026-09-18. Critical: 9, High: 24.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-27626 | Critical | 10.0 | 2022-10-20 | A vulnerability regarding concurrent execution using shared resource with improper synchronization ('Race Condition') is found in the session processing functi… |
CVE-2022-27625 | Critical | 10.0 | 2022-10-20 | A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the message processing functionality of Out-of-Ba… |
CVE-2022-27624 | Critical | 10.0 | 2022-10-20 | A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the packet decryption functionality of Out-of-Ban… |
CVE-2026-13684 | Critical | 9.8 | 2026-09-18 | An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and… |
CVE-2026-13639 | Critical | 9.8 | 2026-09-18 | An insufficient entropy vulnerability in login logic in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 al… |
CVE-2024-10441 | Critical | 9.8 | 2025-03-19 | Improper encoding or escaping of output vulnerability in the system plugin daemon in Synology BeeStation OS (BSM) before 1.1-65374 and Synology DiskStation Man… |
CVE-2022-22687 | Critical | 9.8 | 2022-03-25 | Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in Authentication functionality in Synology DiskStation Manager (DSM) befo… |
CVE-2021-27649 | Critical | 9.8 | 2021-06-23 | Use after free vulnerability in file transfer protocol component in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to execute… |
CVE-2024-45538 | Critical | 9.6 | 2025-12-04 | Cross-Site Request Forgery (CSRF) vulnerability in WebAPI Framework in Synology DiskStation Manager (DSM) before 7.2.1-69057-2 and 7.2.2-72806 and Synology Uni… |
CVE-2026-13673 | High | 8.8 | 2026-09-18 | An incorrect permission assignment for critical resource vulnerability in LDAP API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9… |
CVE-2022-22688 | High | 8.8 | 2022-03-25 | Improper neutralization of special elements used in a command ('Command Injection') vulnerability in File service functionality in Synology DiskStation Manager… |
CVE-2017-15889 | High | 8.8 | 2017-12-04 | Command injection vulnerability in smart.cgi in Synology DiskStation Manager (DSM) before 5.2-5967-5 allows remote authenticated users to execute arbitrary com… |
CVE-2021-29085 | High | 8.6 | 2021-06-23 | Improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in file sharing management component in Synolo… |
CVE-2020-27652 | High | 8.3 | 2020-10-29 | Algorithm downgrade vulnerability in QuickConnect in Synology DiskStation Manager (DSM) before 6.2.3-25426-2 allows man-in-the-middle attackers to spoof server… |
CVE-2020-27648 | High | 8.3 | 2020-10-29 | Improper certificate validation vulnerability in OpenVPN client in Synology DiskStation Manager (DSM) before 6.2.3-25426-2 allows man-in-the-middle attackers t… |
CVE-2018-8919 | High | 8.3 | 2018-12-24 | Information exposure vulnerability in SYNO.Core.Desktop.SessionData in Synology DiskStation Manager (DSM) before 6.1.6-15266 allows remote attackers to steal c… |
CVE-2021-26563 | High | 8.2 | 2021-02-26 | Incorrect authorization vulnerability in synoagentregisterd in Synology DiskStation Manager (DSM) before 6.2.4-25553 allows local users to execute arbitrary co… |
CVE-2026-6205 | High | 8.1 | 2026-09-18 | An external control of file name or path vulnerability in Upload API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4… |
CVE-2025-13392 | High | 8.1 | 2026-05-27 | Improper check for unusual or exceptional conditions vulnerability in SSO in Synology DiskStation Manager (DSM) before 7.2.2-72806-5 and 7.3.1-86003-1 (7.2.1-6… |
CVE-2026-40530 | High | 8.0 | 2026-09-18 | An improper neutralization of CRLF sequences ('CRLF injection') vulnerability in User API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72… |