Synology DiskStation Manager: Multiple Vulnerabilities
A BSI Warn- und Informationsdienst (WID): Schwachstellen-Informationen (Bürger Cert) ·
Admiralty grading (A–F · 1–6)
Source reliability
- A Completely reliable
- B Usually reliable
- C Fairly reliable
- D Not usually reliable
- E Unreliable
- F Cannot be judged
Information credibility
- 1 Confirmed
- 2 Probably true
- 3 Possibly true
- 4 Doubtful
- 5 Improbable
- 6 Cannot be judged
NATO Admiralty (AJP-2.1) grades confidence, independent of the risk score. Cross-source corroboration isn't tracked for non-CVE news, so single-source items are capped at a lower credibility number; a low number does not imply low quality.
Key insight
The alert bundles several vulnerability classes in Synology DSM but provides no CVE IDs and no indication of active exploitation.
Description
The BSI warning and information service reports multiple vulnerabilities in Synology DiskStation Manager. Causes include improper encoding or masking of output, insufficient entropy, incorrect permission assignment, and external control of filenames and paths. As a result, attackers can manipulate files, trigger denial-of-service attacks, disclose information, and conduct cross-site scripting and SQL injection attacks. The alert contains no CVE IDs and no information on active exploitation or KEV status.
Risk score
- cvss base
- 0.00
- kev bonus
- 0.00
- epss bonus
- 0.00
- poc bonus
- 0.00
- raw before weight
- 0.00
- industry weight
- 1.21
- freshness factor
- 0.50
- exploitability factor
- 1.00
- days old
- 53.00
- vendor mismatch penalty
- 0.00
Path: operational