GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration
Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    1013 vulnerabilities by Synology

    GCVE-1988-2026-0374

    Vulnerability from gna-1988 – Published: 2026-09-11 07:55 – Updated: 2026-09-11 11:36
    VLAI
    Title
    Synology stale DNS allows practical interception of traffic from vulnerable DSM clients
    Summary
    # Synology stale DNS allows practical interception of traffic from vulnerable DSM clients Vendor case: 904909 Suggested severity: High ## Customer advisory Synology customers using the affected DSM and Relayd versions listed below should upgrade immediately. The relevant man-in-the-middle vulnerabilities were fixed in DSM 6.2.3-25426 Update 3. Customers should install the latest DSM version available for their device, and in no case remain on a version earlier than DSM 6.2.3-25426 Update 3 where that update is supported. Devices that cannot run this or a later version should be considered unsupported and unsafe for QuickConnect or relay-based communication. They should be replaced, retired, or isolated from Synology cloud services. ## Summary Previously disclosed vulnerabilities in Synology DSM allowed an attacker positioned between a NAS and Synology's infrastructure to impersonate Synology servers, intercept sensitive information, and, in some cases, manipulate traffic or execute commands. Those vulnerabilities included: * CVE-2021-26560, cleartext transmission by `synoagentregisterd`, allowing an attacker to spoof a Synology server. * CVE-2021-26561 and CVE-2021-26562, memory-corruption vulnerabilities reachable through the same man-in-the-middle position. * CVE-2021-26564 and CVE-2021-26565, allowing `synorelayd` traffic to be intercepted or redirected. * CVE-2021-26566, allowing manipulated inbound QuickConnect traffic to result in command execution. Synology fixed these issues in DSM 6.2.3-25426 Update 3. The new finding described in this advisory is a separate infrastructure condition that makes exploitation of those old client vulnerabilities practical. Synology hostnames were observed resolving to ephemeral cloud IP addresses. Synology subsequently released those addresses back to the cloud provider while client devices continued to retain the old DNS result in cache. When a released address was acquired by a third party, affected clients continued sending traffic intended for Synology to the new, attacker-controlled system. This does not require DNS poisoning, ARP spoofing, phishing, a malicious website, or a conventional on-path position. The stale DNS record itself directs the client to the attacker. ## Observed interception in the wild During a two-week period, four separately released cloud IP addresses previously used by Synology infrastructure were acquired and monitored. The supplied traffic captures cover four collection events between 7 July and 16 July 2026. They contain: * 28 HTTP or HTTPS requests intended for Synology services. * 23 distinct client endpoints. * 22 unique NAS serial numbers, plus one additional client that did not include its serial number in the captured request. * 10 plaintext `synoagentregisterd_dsm` requests. * 14 `Synology Relayd` requests. * Four additional QuickConnect requests. The traffic was received without targeting individual customers and without interfering with Synology's DNS records. The clients contacted addresses that had legitimately been released by Synology and subsequently assigned to the collection system. This is therefore not a theoretical attack scenario. It is a definitive example of real Synology customer traffic being delivered to a third-party-controlled endpoint. ## Information exposed The information varied by request type, but the captured traffic included: * Authentication keys and token values. * NAS serial numbers and model identifiers. * MAC addresses. * QuickConnect aliases and server identifiers. * HTTP session cookies. * Internal IPv4 and IPv6 addresses. * Internal gateways and network masks. * DDNS hostnames. * Enabled services and internal or externally mapped service ports. * DSM management ports. * Device time zones and other system metadata. The plaintext `/finder/set.php` requests exposed device identifiers, tokens, internal addresses and management ports directly over HTTP. The TLS-based requests successfully connected to a collection system using a self-signed certificate. This demonstrates that the affected clients did not meaningfully authenticate the remote server before transmitting request data. Whether every captured token could subsequently be replayed is not necessary to establish the confidentiality impact. The security failure occurred when private customer and device data intended for Synology was delivered to an unauthorised third party. ## Affected traffic paths The intercepted requests were intended for hostnames including: * `relayinfo.synology.com` * `global.quickconnect.to` * `dec.quickconnect.to` * `ukc.synology.com` The traffic included requests to: * `/finder/set.php` * `/Serv.php` * `/alias_update.php` Cisco Talos previously documented the same `synoagentregisterd` sequence. A DSM device first requested a finder server from `global.quickconnect.to`, then transmitted its serial number, token, network addresses and DSM ports using plaintext HTTP. Talos concluded that both stages could be modified by a man-in-the-middle attacker. Talos also documented QuickConnect server impersonation capable of stealing device credentials through the `synorelayd` and HTTP-redirection flow. The stale-DNS condition supplies the attacker-controlled endpoint required by these vulnerabilities without requiring the attacker to compromise DNS or obtain an existing network position. ## Captured client versions All captured clients pre-date DSM 6.2.3-25426 Update 3. | Captured version | Identified models | Distinct endpoints | | ------------------------ | ----------------------- | -----------------: | | Synology Relayd 1.0-3211 | Model not disclosed | 1 | | Synology Relayd 1.0-3810 | Model not disclosed | 1 | | Synology Relayd 1.0-3827 | DS210j, DS212j, DS710+ | 4 | | Synology Relayd 1.0-4493 | DS214+, DS414slim | 5 | | DSM 5.0-4528 | DS214play | 1 | | DSM 5.0-4528 Update 1 | DS713+ | 1 | | DSM 5.0-4528 Update 2 | DS213j | 1 | | DSM 5.2-5592 Update 4 | DS214se | 1 | | DSM 5.2-5967 Update 9 | DS1010+, DS115j, RS815+ | 4 | | DSM 6.0-8451 | DS416j | 1 | | DSM 6.0-8754 Update 8 | DS215+, DS216j | 3 | | Total | | 23 | ## Required remediation ### Devices that support the patched DSM release The following identified models can install DSM 6.2.3-25426 Update 3 or a later DSM release: * DS212j * DS213j * DS214+ * DS214play * DS214se * DS215+ * DS216j * DS414slim * DS416j * DS713+ * DS115j * RS815+ Owners should install the latest DSM version currently offered for the specific model. DSM 6.2.3-25426 Update 3 is only the minimum version known to contain the relevant fixes and should not be treated as the preferred current version. Synology's model release notes confirm availability of the fixed branch for these hardware generations. ### Devices with no patched DSM release The following captured 10-series models are limited to DSM 5.2 and cannot install the fixed DSM branch: * DS1010+ * DS210j * DS710+ Synology states that DSM 5.2 was the final major DSM release for 10-series devices. There is therefore no safe software upgrade for these devices in relation to the vulnerabilities described in Synology-SA-20:26. Customers should replace or retire them. Until replacement, owners should disable QuickConnect and related relay functionality, restrict outbound connectivity to Synology relay and finder services, and prevent the devices from transmitting sensitive registration data over the internet. The two unidentified clients using Relayd 1.0-3211 and 1.0-3810 should be identified by their owners. If their hardware cannot install DSM 6.2.3-25426 Update 3 or later, the same replacement recommendation applies. ## Historical exposure It is not known: * How long Synology's infrastructure has released ephemeral addresses while DNS caches remained valid. * How frequently previously used addresses have been acquired by unrelated cloud customers. * Whether other parties deliberately searched for and acquired released Synology addresses. * How many clients have previously sent requests to unintended recipients. * How much customer data may have been collected before this report. * Whether any exposed keys, tokens or session values were replayed or otherwise abused. Four independent ephemeral addresses were encountered during a short observation period. This suggests that the condition was repeatable rather than an isolated cloud-allocation anomaly. The absence of known reports of exploitation cannot establish that prior interception did not occur. A party receiving this traffic would not need to interact with the affected NAS, modify a request, or trigger an observable failure. Passive collection could occur without the customer or Synology becoming aware of it. ## Vendor disclosure timeline | Date | Event | | ----------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | 7 July 2026 | Initial report submitted to Synology with a captured traffic log. | | 8 July 2026 | Synology classified the issue as a hardening suggestion, stating that a complete exploit had not been demonstrated and referring to phishing or fake-site behaviour that was not part of the report. | | 8 July 2026 | Synology was informed that the attachment contained live third-party traffic, identifiers and token values, and was asked to consider notifying the affected customers. | | 9 July 2026 | Synology acknowledged that the log contained live traffic and token-like values, but said replay or account compromise had not been demonstrated. | | 9 July 2026 | Synology was informed that its HTTPS traffic had connected to a self-signed collection endpoint, demonstrating ineffective certificate validation. | | 9 July 2026 | Synology described the result as, at most, limited information exposure. | | 9 to 16 July 2026 | Additional released IP addresses were acquired and further independent batches of customer traffic were captured and supplied. | | 22 July 2026 | Synology stated that the TLS certificate-validation behaviour had been fixed in later DSM versions and maintained that the report was not bounty eligible. | | 22 July 2026 | Synology was reminded that the stale-DNS condition made the old client vulnerability practically exploitable and that the duration and historical extent of exposure were unknown. | | 22 July 2026 | Synology stated that it would adjust the configuration of `relayinfo.synology.com` to further reduce the risk. | | 22 July 2026 | Synology maintained the "hardening suggestion" classification and declined a monetary reward. | ## Assessment of Synology's response Synology is correct that every client observed in the captures was old and pre-dated the relevant security update. That fact does not invalidate the finding. The stale-DNS condition was present in Synology-controlled infrastructure at the time of reporting. It t
    Severity
    No CVSS data available.
    Assigner
    References
    Impacted products
    Vendor Product Version
    Synology stale DNS Affected: unknown
    		Create a notification for this product.
    Credits
    shed riot
    Relationships
    reference GCVE-1988-2026-0374 (this record)
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "stale DNS",
          "vendor": "Synology",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "shed riot"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "# Synology stale DNS allows practical interception of traffic from\nvulnerable DSM clients\n\nVendor case: 904909\nSuggested severity: High\n\n## Customer advisory\n\nSynology customers using the affected DSM and Relayd versions listed below\nshould upgrade immediately.\n\nThe relevant man-in-the-middle vulnerabilities were fixed in DSM\n6.2.3-25426 Update 3. Customers should install the latest DSM version\navailable for their device, and in no case remain on a version earlier than\nDSM 6.2.3-25426 Update 3 where that update is supported.\n\nDevices that cannot run this or a later version should be considered\nunsupported and unsafe for QuickConnect or relay-based communication. They\nshould be replaced, retired, or isolated from Synology cloud services.\n\n## Summary\n\nPreviously disclosed vulnerabilities in Synology DSM allowed an attacker\npositioned between a NAS and Synology\u0027s infrastructure to impersonate\nSynology servers, intercept sensitive information, and, in some cases,\nmanipulate traffic or execute commands.\n\nThose vulnerabilities included:\n\n* CVE-2021-26560, cleartext transmission by `synoagentregisterd`, allowing\nan attacker to spoof a Synology server.\n* CVE-2021-26561 and CVE-2021-26562, memory-corruption vulnerabilities\nreachable through the same man-in-the-middle position.\n* CVE-2021-26564 and CVE-2021-26565, allowing `synorelayd` traffic to be\nintercepted or redirected.\n* CVE-2021-26566, allowing manipulated inbound QuickConnect traffic to\nresult in command execution.\n\nSynology fixed these issues in DSM 6.2.3-25426 Update 3.\n\nThe new finding described in this advisory is a separate infrastructure\ncondition that makes exploitation of those old client vulnerabilities\npractical.\n\nSynology hostnames were observed resolving to ephemeral cloud IP addresses.\nSynology subsequently released those addresses back to the cloud provider\nwhile client devices continued to retain the old DNS result in cache. When\na released address was acquired by a third party, affected clients\ncontinued sending traffic intended for Synology to the new,\nattacker-controlled system.\n\nThis does not require DNS poisoning, ARP spoofing, phishing, a malicious\nwebsite, or a conventional on-path position. The stale DNS record itself\ndirects the client to the attacker.\n\n## Observed interception in the wild\n\nDuring a two-week period, four separately released cloud IP addresses\npreviously used by Synology infrastructure were acquired and monitored.\n\nThe supplied traffic captures cover four collection events between 7 July\nand 16 July 2026. They contain:\n\n* 28 HTTP or HTTPS requests intended for Synology services.\n* 23 distinct client endpoints.\n* 22 unique NAS serial numbers, plus one additional client that did not\ninclude its serial number in the captured request.\n* 10 plaintext `synoagentregisterd_dsm` requests.\n* 14 `Synology Relayd` requests.\n* Four additional QuickConnect requests.\n\nThe traffic was received without targeting individual customers and without\ninterfering with Synology\u0027s DNS records. The clients contacted addresses\nthat had legitimately been released by Synology and subsequently assigned\nto the collection system.\n\nThis is therefore not a theoretical attack scenario. It is a definitive\nexample of real Synology customer traffic being delivered to a\nthird-party-controlled endpoint.\n\n## Information exposed\n\nThe information varied by request type, but the captured traffic included:\n\n* Authentication keys and token values.\n* NAS serial numbers and model identifiers.\n* MAC addresses.\n* QuickConnect aliases and server identifiers.\n* HTTP session cookies.\n* Internal IPv4 and IPv6 addresses.\n* Internal gateways and network masks.\n* DDNS hostnames.\n* Enabled services and internal or externally mapped service ports.\n* DSM management ports.\n* Device time zones and other system metadata.\n\nThe plaintext `/finder/set.php` requests exposed device identifiers,\ntokens, internal addresses and management ports directly over HTTP.\n\nThe TLS-based requests successfully connected to a collection system using\na self-signed certificate. This demonstrates that the affected clients did\nnot meaningfully authenticate the remote server before transmitting request\ndata.\n\nWhether every captured token could subsequently be replayed is not\nnecessary to establish the confidentiality impact. The security failure\noccurred when private customer and device data intended for Synology was\ndelivered to an unauthorised third party.\n\n## Affected traffic paths\n\nThe intercepted requests were intended for hostnames including:\n\n* `relayinfo.synology.com`\n* `global.quickconnect.to`\n* `dec.quickconnect.to`\n* `ukc.synology.com`\n\nThe traffic included requests to:\n\n* `/finder/set.php`\n* `/Serv.php`\n* `/alias_update.php`\n\nCisco Talos previously documented the same `synoagentregisterd` sequence. A\nDSM device first requested a finder server from `global.quickconnect.to`,\nthen transmitted its serial number, token, network addresses and DSM ports\nusing plaintext HTTP. Talos concluded that both stages could be modified by\na man-in-the-middle attacker.\n\nTalos also documented QuickConnect server impersonation capable of stealing\ndevice credentials through the `synorelayd` and HTTP-redirection flow.\n\nThe stale-DNS condition supplies the attacker-controlled endpoint required\nby these vulnerabilities without requiring the attacker to compromise DNS\nor obtain an existing network position.\n\n## Captured client versions\n\nAll captured clients pre-date DSM 6.2.3-25426 Update 3.\n\n| Captured version         | Identified models       | Distinct endpoints |\n| ------------------------ | ----------------------- | -----------------: |\n| Synology Relayd 1.0-3211 | Model not disclosed     |                  1 |\n| Synology Relayd 1.0-3810 | Model not disclosed     |                  1 |\n| Synology Relayd 1.0-3827 | DS210j, DS212j, DS710+  |                  4 |\n| Synology Relayd 1.0-4493 | DS214+, DS414slim       |                  5 |\n| DSM 5.0-4528             | DS214play               |                  1 |\n| DSM 5.0-4528 Update 1    | DS713+                  |                  1 |\n| DSM 5.0-4528 Update 2    | DS213j                  |                  1 |\n| DSM 5.2-5592 Update 4    | DS214se                 |                  1 |\n| DSM 5.2-5967 Update 9    | DS1010+, DS115j, RS815+ |                  4 |\n| DSM 6.0-8451             | DS416j                  |                  1 |\n| DSM 6.0-8754 Update 8    | DS215+, DS216j          |                  3 |\n| Total                    |                         |                 23 |\n\n## Required remediation\n\n### Devices that support the patched DSM release\n\nThe following identified models can install DSM 6.2.3-25426 Update 3 or a\nlater DSM release:\n\n* DS212j\n* DS213j\n* DS214+\n* DS214play\n* DS214se\n* DS215+\n* DS216j\n* DS414slim\n* DS416j\n* DS713+\n* DS115j\n* RS815+\n\nOwners should install the latest DSM version currently offered for the\nspecific model. DSM 6.2.3-25426 Update 3 is only the minimum version known\nto contain the relevant fixes and should not be treated as the preferred\ncurrent version. Synology\u0027s model release notes confirm availability of the\nfixed branch for these hardware generations.\n\n### Devices with no patched DSM release\n\nThe following captured 10-series models are limited to DSM 5.2 and cannot\ninstall the fixed DSM branch:\n\n* DS1010+\n* DS210j\n* DS710+\n\nSynology states that DSM 5.2 was the final major DSM release for 10-series\ndevices.\n\nThere is therefore no safe software upgrade for these devices in relation\nto the vulnerabilities described in Synology-SA-20:26. Customers should\nreplace or retire them.\n\nUntil replacement, owners should disable QuickConnect and related relay\nfunctionality, restrict outbound connectivity to Synology relay and finder\nservices, and prevent the devices from transmitting sensitive registration\ndata over the internet.\n\nThe two unidentified clients using Relayd 1.0-3211 and 1.0-3810 should be\nidentified by their owners. If their hardware cannot install DSM\n6.2.3-25426 Update 3 or later, the same replacement recommendation applies.\n\n## Historical exposure\n\nIt is not known:\n\n* How long Synology\u0027s infrastructure has released ephemeral addresses while\nDNS caches remained valid.\n* How frequently previously used addresses have been acquired by unrelated\ncloud customers.\n* Whether other parties deliberately searched for and acquired released\nSynology addresses.\n* How many clients have previously sent requests to unintended recipients.\n* How much customer data may have been collected before this report.\n* Whether any exposed keys, tokens or session values were replayed or\notherwise abused.\n\nFour independent ephemeral addresses were encountered during a short\nobservation period. This suggests that the condition was repeatable rather\nthan an isolated cloud-allocation anomaly.\n\nThe absence of known reports of exploitation cannot establish that prior\ninterception did not occur. A party receiving this traffic would not need\nto interact with the affected NAS, modify a request, or trigger an\nobservable failure. Passive collection could occur without the customer or\nSynology becoming aware of it.\n\n## Vendor disclosure timeline\n\n| Date              | Event\n\n                                                                   |\n| ----------------- |\n----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------\n|\n| 7 July 2026       | Initial report submitted to Synology with a captured\ntraffic log.\n                                                                     |\n| 8 July 2026       | Synology classified the issue as a hardening\nsuggestion, stating that a complete exploit had not been demonstrated and\nreferring to phishing or fake-site behaviour that was not part of the\nreport. |\n| 8 July 2026       | Synology was informed that the attachment contained\nlive third-party traffic, identifiers and token values, and was asked to\nconsider notifying the affected customers.                              |\n| 9 July 2026       | Synology acknowledged that the log contained live\ntraffic and token-like values, but said replay or account compromise had\nnot been demonstrated.                                                    |\n| 9 July 2026       | Synology was informed that its HTTPS traffic had\nconnected to a self-signed collection endpoint, demonstrating ineffective\ncertificate validation.                                                   |\n| 9 July 2026       | Synology described the result as, at most, limited\ninformation exposure.\n                                                                      |\n| 9 to 16 July 2026 | Additional released IP addresses were acquired and\nfurther independent batches of customer traffic were captured and supplied.\n                                                                      |\n| 22 July 2026      | Synology stated that the TLS certificate-validation\nbehaviour had been fixed in later DSM versions and maintained that the\nreport was not bounty eligible.                                           |\n| 22 July 2026      | Synology was reminded that the stale-DNS condition\nmade the old client vulnerability practically exploitable and that the\nduration and historical extent of exposure were unknown.                   |\n| 22 July 2026      | Synology stated that it would adjust the\nconfiguration of `relayinfo.synology.com` to further reduce the risk.\n\n    |\n| 22 July 2026      | Synology maintained the \"hardening suggestion\"\nclassification and declined a monetary reward.\n                                                                           |\n\n\n## Assessment of Synology\u0027s response\n\nSynology is correct that every client observed in the captures was old and\npre-dated the relevant security update.\n\nThat fact does not invalidate the finding.\n\nThe stale-DNS condition was present in Synology-controlled infrastructure\nat the time of reporting. It t"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:36:42Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/28"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jul/28"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jul/28"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Synology stale DNS allows practical interception of traffic from vulnerable DSM clients",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2021-26560",
              "type": "related"
            },
            {
              "destId": "CVE-2021-26561",
              "type": "related"
            },
            {
              "destId": "CVE-2021-26562",
              "type": "related"
            },
            {
              "destId": "CVE-2021-26564",
              "type": "related"
            },
            {
              "destId": "CVE-2021-26565",
              "type": "related"
            },
            {
              "destId": "CVE-2021-26566",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0374",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/28",
            "automated": true,
            "contentSha256": "bd8f367c2ed2bbbcd5c32d5122025267d13ee7dbffbbbc16a203899c4f1f006e",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jul/28",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-07-22T08:27:45Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0374"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T07:55:58Z",
    "dateUpdated": "2026-09-11T11:36:42Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0374"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    GCVE-1988-2026-0157

    Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-11 11:36
    VLAI
    Title
    Synology stale DNS allows practical interception of traffic from vulnerable DSM clients
    Summary
    # Synology stale DNS allows practical interception of traffic from vulnerable DSM clients Vendor case: 904909 Suggested severity: High ## Customer advisory Synology customers using the affected DSM and Relayd versions listed below should upgrade immediately. The relevant man-in-the-middle vulnerabilities were fixed in DSM 6.2.3-25426 Update 3. Customers should install the latest DSM version available for their device, and in no case remain on a version earlier than DSM 6.2.3-25426 Update 3 where that update is supported. Devices that cannot run this or a later version should be considered unsupported and unsafe for QuickConnect or relay-based communication. They should be replaced, retired, or isolated from Synology cloud services. ## Summary Previously disclosed vulnerabilities in Synology DSM allowed an attacker positioned between a NAS and Synology's infrastructure to impersonate Synology servers, intercept sensitive information, and, in some cases, manipulate traffic or execute commands. Those vulnerabilities included: * CVE-2021-26560, cleartext transmission by `synoagentregisterd`, allowing an attacker to spoof a Synology server. * CVE-2021-26561 and CVE-2021-26562, memory-corruption vulnerabilities reachable through the same man-in-the-middle position. * CVE-2021-26564 and CVE-2021-26565, allowing `synorelayd` traffic to be intercepted or redirected. * CVE-2021-26566, allowing manipulated inbound QuickConnect traffic to result in command execution. Synology fixed these issues in DSM 6.2.3-25426 Update 3. The new finding described in this advisory is a separate infrastructure condition that makes exploitation of those old client vulnerabilities practical. Synology hostnames were observed resolving to ephemeral cloud IP addresses. Synology subsequently released those addresses back to the cloud provider while client devices continued to retain the old DNS result in cache. When a released address was acquired by a third party, affected clients continued sending traffic intended for Synology to the new, attacker-controlled system. This does not require DNS poisoning, ARP spoofing, phishing, a malicious website, or a conventional on-path position. The stale DNS record itself directs the client to the attacker. ## Observed interception in the wild During a two-week period, four separately released cloud IP addresses previously used by Synology infrastructure were acquired and monitored. The supplied traffic captures cover four collection events between 7 July and 16 July 2026. They contain: * 28 HTTP or HTTPS requests intended for Synology services. * 23 distinct client endpoints. * 22 unique NAS serial numbers, plus one additional client that did not include its serial number in the captured request. * 10 plaintext `synoagentregisterd_dsm` requests. * 14 `Synology Relayd` requests. * Four additional QuickConnect requests. The traffic was received without targeting individual customers and without interfering with Synology's DNS records. The clients contacted addresses that had legitimately been released by Synology and subsequently assigned to the collection system. This is therefore not a theoretical attack scenario. It is a definitive example of real Synology customer traffic being delivered to a third-party-controlled endpoint. ## Information exposed The information varied by request type, but the captured traffic included: * Authentication keys and token values. * NAS serial numbers and model identifiers. * MAC addresses. * QuickConnect aliases and server identifiers. * HTTP session cookies. * Internal IPv4 and IPv6 addresses. * Internal gateways and network masks. * DDNS hostnames. * Enabled services and internal or externally mapped service ports. * DSM management ports. * Device time zones and other system metadata. The plaintext `/finder/set.php` requests exposed device identifiers, tokens, internal addresses and management ports directly over HTTP. The TLS-based requests successfully connected to a collection system using a self-signed certificate. This demonstrates that the affected clients did not meaningfully authenticate the remote server before transmitting request data. Whether every captured token could subsequently be replayed is not necessary to establish the confidentiality impact. The security failure occurred when private customer and device data intended for Synology was delivered to an unauthorised third party. ## Affected traffic paths The intercepted requests were intended for hostnames including: * `relayinfo.synology.com` * `global.quickconnect.to` * `dec.quickconnect.to` * `ukc.synology.com` The traffic included requests to: * `/finder/set.php` * `/Serv.php` * `/alias_update.php` Cisco Talos previously documented the same `synoagentregisterd` sequence. A DSM device first requested a finder server from `global.quickconnect.to`, then transmitted its serial number, token, network addresses and DSM ports using plaintext HTTP. Talos concluded that both stages could be modified by a man-in-the-middle attacker. Talos also documented QuickConnect server impersonation capable of stealing device credentials through the `synorelayd` and HTTP-redirection flow. The stale-DNS condition supplies the attacker-controlled endpoint required by these vulnerabilities without requiring the attacker to compromise DNS or obtain an existing network position. ## Captured client versions All captured clients pre-date DSM 6.2.3-25426 Update 3. | Captured version | Identified models | Distinct endpoints | | ------------------------ | ----------------------- | -----------------: | | Synology Relayd 1.0-3211 | Model not disclosed | 1 | | Synology Relayd 1.0-3810 | Model not disclosed | 1 | | Synology Relayd 1.0-3827 | DS210j, DS212j, DS710+ | 4 | | Synology Relayd 1.0-4493 | DS214+, DS414slim | 5 | | DSM 5.0-4528 | DS214play | 1 | | DSM 5.0-4528 Update 1 | DS713+ | 1 | | DSM 5.0-4528 Update 2 | DS213j | 1 | | DSM 5.2-5592 Update 4 | DS214se | 1 | | DSM 5.2-5967 Update 9 | DS1010+, DS115j, RS815+ | 4 | | DSM 6.0-8451 | DS416j | 1 | | DSM 6.0-8754 Update 8 | DS215+, DS216j | 3 | | Total | | 23 | ## Required remediation ### Devices that support the patched DSM release The following identified models can install DSM 6.2.3-25426 Update 3 or a later DSM release: * DS212j * DS213j * DS214+ * DS214play * DS214se * DS215+ * DS216j * DS414slim * DS416j * DS713+ * DS115j * RS815+ Owners should install the latest DSM version currently offered for the specific model. DSM 6.2.3-25426 Update 3 is only the minimum version known to contain the relevant fixes and should not be treated as the preferred current version. Synology's model release notes confirm availability of the fixed branch for these hardware generations. ### Devices with no patched DSM release The following captured 10-series models are limited to DSM 5.2 and cannot install the fixed DSM branch: * DS1010+ * DS210j * DS710+ Synology states that DSM 5.2 was the final major DSM release for 10-series devices. There is therefore no safe software upgrade for these devices in relation to the vulnerabilities described in Synology-SA-20:26. Customers should replace or retire them. Until replacement, owners should disable QuickConnect and related relay functionality, restrict outbound connectivity to Synology relay and finder services, and prevent the devices from transmitting sensitive registration data over the internet. The two unidentified clients using Relayd 1.0-3211 and 1.0-3810 should be identified by their owners. If their hardware cannot install DSM 6.2.3-25426 Update 3 or later, the same replacement recommendation applies. ## Historical exposure It is not known: * How long Synology's infrastructure has released ephemeral addresses while DNS caches remained valid. * How frequently previously used addresses have been acquired by unrelated cloud customers. * Whether other parties deliberately searched for and acquired released Synology addresses. * How many clients have previously sent requests to unintended recipients. * How much customer data may have been collected before this report. * Whether any exposed keys, tokens or session values were replayed or otherwise abused. Four independent ephemeral addresses were encountered during a short observation period. This suggests that the condition was repeatable rather than an isolated cloud-allocation anomaly. The absence of known reports of exploitation cannot establish that prior interception did not occur. A party receiving this traffic would not need to interact with the affected NAS, modify a request, or trigger an observable failure. Passive collection could occur without the customer or Synology becoming aware of it. ## Vendor disclosure timeline | Date | Event | | ----------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | 7 July 2026 | Initial report submitted to Synology with a captured traffic log. | | 8 July 2026 | Synology classified the issue as a hardening suggestion, stating that a complete exploit had not been demonstrated and referring to phishing or fake-site behaviour that was not part of the report. | | 8 July 2026 | Synology was informed that the attachment contained live third-party traffic, identifiers and token values, and was asked to consider notifying the affected customers. | | 9 July 2026 | Synology acknowledged that the log contained live traffic and token-like values, but said replay or account compromise had not been demonstrated. | | 9 July 2026 | Synology was informed that its HTTPS traffic had connected to a self-signed collection endpoint, demonstrating ineffective certificate validation. | | 9 July 2026 | Synology described the result as, at most, limited information exposure. | | 9 to 16 July 2026 | Additional released IP addresses were acquired and further independent batches of customer traffic were captured and supplied. | | 22 July 2026 | Synology stated that the TLS certificate-validation behaviour had been fixed in later DSM versions and maintained that the report was not bounty eligible. | | 22 July 2026 | Synology was reminded that the stale-DNS condition made the old client vulnerability practically exploitable and that the duration and historical extent of exposure were unknown. | | 22 July 2026 | Synology stated that it would adjust the configuration of `relayinfo.synology.com` to further reduce the risk. | | 22 July 2026 | Synology maintained the "hardening suggestion" classification and declined a monetary reward. | ## Assessment of Synology's response Synology is correct that every client observed in the captures was old and pre-dated the relevant security update. That fact does not invalidate the finding. The stale-DNS condition was present in Synology-controlled infrastructure at the time of reporting. It t
    Severity
    No CVSS data available.
    Assigner
    References
    Impacted products
    Vendor Product Version
    Synology stale DNS Affected: unknown
    		Create a notification for this product.
    Credits
    shed riot
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "stale DNS",
          "vendor": "Synology",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "shed riot"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "# Synology stale DNS allows practical interception of traffic from\nvulnerable DSM clients\n\nVendor case: 904909\nSuggested severity: High\n\n## Customer advisory\n\nSynology customers using the affected DSM and Relayd versions listed below\nshould upgrade immediately.\n\nThe relevant man-in-the-middle vulnerabilities were fixed in DSM\n6.2.3-25426 Update 3. Customers should install the latest DSM version\navailable for their device, and in no case remain on a version earlier than\nDSM 6.2.3-25426 Update 3 where that update is supported.\n\nDevices that cannot run this or a later version should be considered\nunsupported and unsafe for QuickConnect or relay-based communication. They\nshould be replaced, retired, or isolated from Synology cloud services.\n\n## Summary\n\nPreviously disclosed vulnerabilities in Synology DSM allowed an attacker\npositioned between a NAS and Synology\u0027s infrastructure to impersonate\nSynology servers, intercept sensitive information, and, in some cases,\nmanipulate traffic or execute commands.\n\nThose vulnerabilities included:\n\n* CVE-2021-26560, cleartext transmission by `synoagentregisterd`, allowing\nan attacker to spoof a Synology server.\n* CVE-2021-26561 and CVE-2021-26562, memory-corruption vulnerabilities\nreachable through the same man-in-the-middle position.\n* CVE-2021-26564 and CVE-2021-26565, allowing `synorelayd` traffic to be\nintercepted or redirected.\n* CVE-2021-26566, allowing manipulated inbound QuickConnect traffic to\nresult in command execution.\n\nSynology fixed these issues in DSM 6.2.3-25426 Update 3.\n\nThe new finding described in this advisory is a separate infrastructure\ncondition that makes exploitation of those old client vulnerabilities\npractical.\n\nSynology hostnames were observed resolving to ephemeral cloud IP addresses.\nSynology subsequently released those addresses back to the cloud provider\nwhile client devices continued to retain the old DNS result in cache. When\na released address was acquired by a third party, affected clients\ncontinued sending traffic intended for Synology to the new,\nattacker-controlled system.\n\nThis does not require DNS poisoning, ARP spoofing, phishing, a malicious\nwebsite, or a conventional on-path position. The stale DNS record itself\ndirects the client to the attacker.\n\n## Observed interception in the wild\n\nDuring a two-week period, four separately released cloud IP addresses\npreviously used by Synology infrastructure were acquired and monitored.\n\nThe supplied traffic captures cover four collection events between 7 July\nand 16 July 2026. They contain:\n\n* 28 HTTP or HTTPS requests intended for Synology services.\n* 23 distinct client endpoints.\n* 22 unique NAS serial numbers, plus one additional client that did not\ninclude its serial number in the captured request.\n* 10 plaintext `synoagentregisterd_dsm` requests.\n* 14 `Synology Relayd` requests.\n* Four additional QuickConnect requests.\n\nThe traffic was received without targeting individual customers and without\ninterfering with Synology\u0027s DNS records. The clients contacted addresses\nthat had legitimately been released by Synology and subsequently assigned\nto the collection system.\n\nThis is therefore not a theoretical attack scenario. It is a definitive\nexample of real Synology customer traffic being delivered to a\nthird-party-controlled endpoint.\n\n## Information exposed\n\nThe information varied by request type, but the captured traffic included:\n\n* Authentication keys and token values.\n* NAS serial numbers and model identifiers.\n* MAC addresses.\n* QuickConnect aliases and server identifiers.\n* HTTP session cookies.\n* Internal IPv4 and IPv6 addresses.\n* Internal gateways and network masks.\n* DDNS hostnames.\n* Enabled services and internal or externally mapped service ports.\n* DSM management ports.\n* Device time zones and other system metadata.\n\nThe plaintext `/finder/set.php` requests exposed device identifiers,\ntokens, internal addresses and management ports directly over HTTP.\n\nThe TLS-based requests successfully connected to a collection system using\na self-signed certificate. This demonstrates that the affected clients did\nnot meaningfully authenticate the remote server before transmitting request\ndata.\n\nWhether every captured token could subsequently be replayed is not\nnecessary to establish the confidentiality impact. The security failure\noccurred when private customer and device data intended for Synology was\ndelivered to an unauthorised third party.\n\n## Affected traffic paths\n\nThe intercepted requests were intended for hostnames including:\n\n* `relayinfo.synology.com`\n* `global.quickconnect.to`\n* `dec.quickconnect.to`\n* `ukc.synology.com`\n\nThe traffic included requests to:\n\n* `/finder/set.php`\n* `/Serv.php`\n* `/alias_update.php`\n\nCisco Talos previously documented the same `synoagentregisterd` sequence. A\nDSM device first requested a finder server from `global.quickconnect.to`,\nthen transmitted its serial number, token, network addresses and DSM ports\nusing plaintext HTTP. Talos concluded that both stages could be modified by\na man-in-the-middle attacker.\n\nTalos also documented QuickConnect server impersonation capable of stealing\ndevice credentials through the `synorelayd` and HTTP-redirection flow.\n\nThe stale-DNS condition supplies the attacker-controlled endpoint required\nby these vulnerabilities without requiring the attacker to compromise DNS\nor obtain an existing network position.\n\n## Captured client versions\n\nAll captured clients pre-date DSM 6.2.3-25426 Update 3.\n\n| Captured version         | Identified models       | Distinct endpoints |\n| ------------------------ | ----------------------- | -----------------: |\n| Synology Relayd 1.0-3211 | Model not disclosed     |                  1 |\n| Synology Relayd 1.0-3810 | Model not disclosed     |                  1 |\n| Synology Relayd 1.0-3827 | DS210j, DS212j, DS710+  |                  4 |\n| Synology Relayd 1.0-4493 | DS214+, DS414slim       |                  5 |\n| DSM 5.0-4528             | DS214play               |                  1 |\n| DSM 5.0-4528 Update 1    | DS713+                  |                  1 |\n| DSM 5.0-4528 Update 2    | DS213j                  |                  1 |\n| DSM 5.2-5592 Update 4    | DS214se                 |                  1 |\n| DSM 5.2-5967 Update 9    | DS1010+, DS115j, RS815+ |                  4 |\n| DSM 6.0-8451             | DS416j                  |                  1 |\n| DSM 6.0-8754 Update 8    | DS215+, DS216j          |                  3 |\n| Total                    |                         |                 23 |\n\n## Required remediation\n\n### Devices that support the patched DSM release\n\nThe following identified models can install DSM 6.2.3-25426 Update 3 or a\nlater DSM release:\n\n* DS212j\n* DS213j\n* DS214+\n* DS214play\n* DS214se\n* DS215+\n* DS216j\n* DS414slim\n* DS416j\n* DS713+\n* DS115j\n* RS815+\n\nOwners should install the latest DSM version currently offered for the\nspecific model. DSM 6.2.3-25426 Update 3 is only the minimum version known\nto contain the relevant fixes and should not be treated as the preferred\ncurrent version. Synology\u0027s model release notes confirm availability of the\nfixed branch for these hardware generations.\n\n### Devices with no patched DSM release\n\nThe following captured 10-series models are limited to DSM 5.2 and cannot\ninstall the fixed DSM branch:\n\n* DS1010+\n* DS210j\n* DS710+\n\nSynology states that DSM 5.2 was the final major DSM release for 10-series\ndevices.\n\nThere is therefore no safe software upgrade for these devices in relation\nto the vulnerabilities described in Synology-SA-20:26. Customers should\nreplace or retire them.\n\nUntil replacement, owners should disable QuickConnect and related relay\nfunctionality, restrict outbound connectivity to Synology relay and finder\nservices, and prevent the devices from transmitting sensitive registration\ndata over the internet.\n\nThe two unidentified clients using Relayd 1.0-3211 and 1.0-3810 should be\nidentified by their owners. If their hardware cannot install DSM\n6.2.3-25426 Update 3 or later, the same replacement recommendation applies.\n\n## Historical exposure\n\nIt is not known:\n\n* How long Synology\u0027s infrastructure has released ephemeral addresses while\nDNS caches remained valid.\n* How frequently previously used addresses have been acquired by unrelated\ncloud customers.\n* Whether other parties deliberately searched for and acquired released\nSynology addresses.\n* How many clients have previously sent requests to unintended recipients.\n* How much customer data may have been collected before this report.\n* Whether any exposed keys, tokens or session values were replayed or\notherwise abused.\n\nFour independent ephemeral addresses were encountered during a short\nobservation period. This suggests that the condition was repeatable rather\nthan an isolated cloud-allocation anomaly.\n\nThe absence of known reports of exploitation cannot establish that prior\ninterception did not occur. A party receiving this traffic would not need\nto interact with the affected NAS, modify a request, or trigger an\nobservable failure. Passive collection could occur without the customer or\nSynology becoming aware of it.\n\n## Vendor disclosure timeline\n\n| Date              | Event\n\n                                                                   |\n| ----------------- |\n----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------\n|\n| 7 July 2026       | Initial report submitted to Synology with a captured\ntraffic log.\n                                                                     |\n| 8 July 2026       | Synology classified the issue as a hardening\nsuggestion, stating that a complete exploit had not been demonstrated and\nreferring to phishing or fake-site behaviour that was not part of the\nreport. |\n| 8 July 2026       | Synology was informed that the attachment contained\nlive third-party traffic, identifiers and token values, and was asked to\nconsider notifying the affected customers.                              |\n| 9 July 2026       | Synology acknowledged that the log contained live\ntraffic and token-like values, but said replay or account compromise had\nnot been demonstrated.                                                    |\n| 9 July 2026       | Synology was informed that its HTTPS traffic had\nconnected to a self-signed collection endpoint, demonstrating ineffective\ncertificate validation.                                                   |\n| 9 July 2026       | Synology described the result as, at most, limited\ninformation exposure.\n                                                                      |\n| 9 to 16 July 2026 | Additional released IP addresses were acquired and\nfurther independent batches of customer traffic were captured and supplied.\n                                                                      |\n| 22 July 2026      | Synology stated that the TLS certificate-validation\nbehaviour had been fixed in later DSM versions and maintained that the\nreport was not bounty eligible.                                           |\n| 22 July 2026      | Synology was reminded that the stale-DNS condition\nmade the old client vulnerability practically exploitable and that the\nduration and historical extent of exposure were unknown.                   |\n| 22 July 2026      | Synology stated that it would adjust the\nconfiguration of `relayinfo.synology.com` to further reduce the risk.\n\n    |\n| 22 July 2026      | Synology maintained the \"hardening suggestion\"\nclassification and declined a monetary reward.\n                                                                           |\n\n\n## Assessment of Synology\u0027s response\n\nSynology is correct that every client observed in the captures was old and\npre-dated the relevant security update.\n\nThat fact does not invalidate the finding.\n\nThe stale-DNS condition was present in Synology-controlled infrastructure\nat the time of reporting. It t"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:36:42Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/28"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jul/28"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jul/28"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Synology stale DNS allows practical interception of traffic from vulnerable DSM clients",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0157",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/28",
            "automated": true,
            "contentSha256": "bd8f367c2ed2bbbcd5c32d5122025267d13ee7dbffbbbc16a203899c4f1f006e",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jul/28",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-07-22T08:27:45Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-11T11:36:42Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0157"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-9548 (GCVE-0-2026-9548)

    Vulnerability from nvd – Published: 2026-08-28 07:08 – Updated: 2026-08-28 11:03
    VLAI
    Summary
    An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in extract domain in Synology Chat Server before 2.4.5-22148 allows remote authenticated users, via a UI interaction, to read or write restricted files and conduct limited denial-of-service attacks in DSM.
    Severity
    6.5 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-28 11:02 UTC
    CWE
    • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    Assigner
    References
    Impacted products
    Vendor Product Version
    Synology Synology Chat Server Affected: * , < 2.4.5-22148 (semver)
    		Create a notification for this product.
    Credits
    Warisse Valentin (Aytio)
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-9548",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-28T11:02:23.550934Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-28T11:03:02.420Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Synology Chat Server",
          "vendor": "Synology",
          "versions": [
            {
              "lessThan": "2.4.5-22148",
              "status": "affected",
              "version": "*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Warisse Valentin (Aytio)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An improper neutralization of input during web page generation (\u0027Cross-site Scripting\u0027) vulnerability in extract domain in Synology Chat Server before 2.4.5-22148 allows remote authenticated users, via a UI interaction, to read or write restricted files and conduct limited denial-of-service attacks in DSM."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-28T07:08:51.584Z",
        "orgId": "db201096-a0cc-46c7-9a55-61d9e221bf01",
        "shortName": "synology"
      },
      "references": [
        {
          "name": "Synology-SA-26:10 Synology Chat Server",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.synology.com/en-global/security/advisory/Synology_SA_26_10"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "db201096-a0cc-46c7-9a55-61d9e221bf01",
    "assignerShortName": "synology",
    "cveId": "CVE-2026-9548",
    "datePublished": "2026-08-28T07:08:51.584Z",
    "dateReserved": "2026-05-26T07:01:48.490Z",
    "dateUpdated": "2026-08-28T11:03:02.420Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-9491 (GCVE-0-2026-9491)

    Vulnerability from nvd – Published: 2026-08-28 07:07 – Updated: 2026-08-28 11:03
    VLAI
    Summary
    A server-ide request forgery (SSRF) vulnerability in webhook in Synology Chat Server before 2.4.5-22148 allows remote authenticated users to obtain non-sensitive information.
    Severity
    4.3 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-28 11:03 UTC
    CWE
    • CWE-918 - Server-Side Request Forgery (SSRF)
    Assigner
    References
    Impacted products
    Vendor Product Version
    Synology Synology Chat Server Affected: * , < 2.4.5-22148 (semver)
    		Create a notification for this product.
    Credits
    Lam Jun Rong and Javier Koh, Cyber Specialists of the Digital and Intelligence Service (DIS) working with the Centre for Strategic Infocomm Technologies (CSIT) and Dr Joseph Teo, CSIT
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-9491",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-28T11:03:41.176635Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-28T11:03:53.629Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Synology Chat Server",
          "vendor": "Synology",
          "versions": [
            {
              "lessThan": "2.4.5-22148",
              "status": "affected",
              "version": "*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Lam Jun Rong and Javier Koh, Cyber Specialists of the Digital and Intelligence Service (DIS) working with the Centre for Strategic Infocomm Technologies (CSIT) and Dr Joseph Teo, CSIT"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A server-ide request forgery (SSRF) vulnerability in webhook in Synology Chat Server before 2.4.5-22148 allows remote authenticated users to obtain non-sensitive information."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-28T07:07:57.240Z",
        "orgId": "db201096-a0cc-46c7-9a55-61d9e221bf01",
        "shortName": "synology"
      },
      "references": [
        {
          "name": "Synology-SA-26:10 Synology Chat Server",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.synology.com/en-global/security/advisory/Synology_SA_26_10"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "db201096-a0cc-46c7-9a55-61d9e221bf01",
    "assignerShortName": "synology",
    "cveId": "CVE-2026-9491",
    "datePublished": "2026-08-28T07:07:57.240Z",
    "dateReserved": "2026-05-25T02:03:55.583Z",
    "dateUpdated": "2026-08-28T11:03:53.629Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-40541 (GCVE-0-2026-40541)

    Vulnerability from nvd – Published: 2026-08-28 07:07 – Updated: 2026-08-28 11:44
    VLAI
    Summary
    An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in extract domain in Synology Chat Server before 2.4.5-22148 allows remote authenticated users, via a UI interaction, to read or write arbitrary files and conduct denial-of-service attacks in DSM.
    Severity
    9 (Critical)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-28 11:31 UTC
    CWE
    • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    Assigner
    References
    Impacted products
    Vendor Product Version
    Synology Synology Chat Server Affected: * , < 2.4.5-22148 (semver)
    		Create a notification for this product.
    Credits
    Lam Jun Rong and Javier Koh, Cyber Specialists of the Digital and Intelligence Service (DIS) working with the Centre for Strategic Infocomm Technologies (CSIT) and Dr Joseph Teo, CSIT
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-40541",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-28T11:31:57.261097Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-28T11:44:42.311Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Synology Chat Server",
          "vendor": "Synology",
          "versions": [
            {
              "lessThan": "2.4.5-22148",
              "status": "affected",
              "version": "*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Lam Jun Rong and Javier Koh, Cyber Specialists of the Digital and Intelligence Service (DIS) working with the Centre for Strategic Infocomm Technologies (CSIT) and Dr Joseph Teo, CSIT"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An improper neutralization of input during web page generation (\u0027Cross-site Scripting\u0027) vulnerability in extract domain in Synology Chat Server before 2.4.5-22148 allows remote authenticated users, via a UI interaction, to read or write arbitrary files and conduct denial-of-service attacks in DSM."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-28T07:07:24.049Z",
        "orgId": "db201096-a0cc-46c7-9a55-61d9e221bf01",
        "shortName": "synology"
      },
      "references": [
        {
          "name": "Synology-SA-26:10 Synology Chat Server",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.synology.com/en-global/security/advisory/Synology_SA_26_10"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "db201096-a0cc-46c7-9a55-61d9e221bf01",
    "assignerShortName": "synology",
    "cveId": "CVE-2026-40541",
    "datePublished": "2026-08-28T07:07:24.049Z",
    "dateReserved": "2026-04-14T01:01:14.607Z",
    "dateUpdated": "2026-08-28T11:44:42.311Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-4793 (GCVE-0-2026-4793)

    Vulnerability from nvd – Published: 2026-08-03 06:00 – Updated: 2026-08-03 14:54
    VLAI
    Summary
    An incorrect default permissions vulnerability in Synology Assistant before 7.0.7-50095 allows local users to read or write arbitrary files and conduct denial-of-service during installation.
    Severity
    7.3 (High)
    CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-03 14:46 UTC
    CWE
    • CWE-276 - Incorrect Default Permissions
    Assigner
    References
    Impacted products
    Vendor Product Version
    Synology Synology Assistant Affected: * , < 7.0.7-50095 (semver)
    		Create a notification for this product.
    Credits
    Kazuma Matsumoto, a security researcher at GMO Cybersecurity by IERAE, Inc.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-4793",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-03T14:46:03.226652Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-03T14:54:10.232Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Synology Assistant",
          "vendor": "Synology",
          "versions": [
            {
              "lessThan": "7.0.7-50095",
              "status": "affected",
              "version": "*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Kazuma Matsumoto, a security researcher at GMO Cybersecurity by IERAE, Inc."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An incorrect default permissions vulnerability in Synology Assistant before 7.0.7-50095 allows local users to read or write arbitrary files and conduct denial-of-service during installation."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-276",
              "description": "Incorrect Default Permissions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-03T06:00:39.179Z",
        "orgId": "db201096-a0cc-46c7-9a55-61d9e221bf01",
        "shortName": "synology"
      },
      "references": [
        {
          "name": "Synology-SA-26:12 Synology Assistant",
          "url": "https://www.synology.com/en-global/security/advisory/Synology_SA_26_12"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "db201096-a0cc-46c7-9a55-61d9e221bf01",
    "assignerShortName": "synology",
    "cveId": "CVE-2026-4793",
    "datePublished": "2026-08-03T06:00:39.179Z",
    "dateReserved": "2026-03-25T00:47:20.775Z",
    "dateUpdated": "2026-08-03T14:54:10.232Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2024-47273 (GCVE-0-2024-47273)

    Vulnerability from nvd – Published: 2026-06-03 13:31 – Updated: 2026-06-03 15:49
    VLAI
    Summary
    An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in Backup Task functionality in Synology Hyper Backup before 4.1.2-4036 allows remote authenticated users to write specific files via unspecified vectors.
    Severity
    4.3 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-06-03 15:49 UTC
    CWE
    • CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
    Assigner
    References
    Impacted products
    Vendor Product Version
    Synology Hyper Backup Affected: * , < 4.1.2-4036 (semver)
    		Create a notification for this product.
    Credits
    Zhao Runzi (赵润梓)
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-47273",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-03T15:49:00.291601Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-03T15:49:08.289Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Hyper Backup",
          "vendor": "Synology",
          "versions": [
            {
              "lessThan": "4.1.2-4036",
              "status": "affected",
              "version": "*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Zhao Runzi (\u8d75\u6da6\u6893)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An improper limitation of a pathname to a restricted directory (\u0027Path Traversal\u0027) vulnerability in Backup Task functionality in Synology Hyper Backup before 4.1.2-4036 allows remote authenticated users to write specific files via unspecified vectors."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-03T13:31:24.351Z",
        "orgId": "db201096-a0cc-46c7-9a55-61d9e221bf01",
        "shortName": "synology"
      },
      "references": [
        {
          "name": "Release note",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.synology.com/en-global/releaseNote/HyperBackup?model=DS224%2B\u0026os=DSM\u0026version=7_x_series"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "db201096-a0cc-46c7-9a55-61d9e221bf01",
    "assignerShortName": "synology",
    "cveId": "CVE-2024-47273",
    "datePublished": "2026-06-03T13:31:24.351Z",
    "dateReserved": "2024-09-24T03:58:57.133Z",
    "dateUpdated": "2026-06-03T15:49:08.289Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2024-47263 (GCVE-0-2024-47263)

    Vulnerability from nvd – Published: 2026-06-03 13:35 – Updated: 2026-06-03 15:49
    VLAI
    Summary
    An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in Backup.Repository webapi component in Synology Hyper Backup before 4.1.2-4036 allows remote authenticated users with administrator privileges to write specific files containing non-sensitive information via unspecified vectors.
    Severity
    4.1 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-06-03 15:49 UTC
    CWE
    • CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
    Assigner
    References
    Impacted products
    Vendor Product Version
    Synology Hyper Backup Affected: * , < 4.1.2-4036 (semver)
    		Create a notification for this product.
    Credits
    Zhao Runzi (赵润梓)
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-47263",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-03T15:49:20.857350Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-03T15:49:29.116Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Hyper Backup",
          "vendor": "Synology",
          "versions": [
            {
              "lessThan": "4.1.2-4036",
              "status": "affected",
              "version": "*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Zhao Runzi (\u8d75\u6da6\u6893)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An improper limitation of a pathname to a restricted directory (\u0027Path Traversal\u0027) vulnerability in Backup.Repository webapi component in Synology Hyper Backup before 4.1.2-4036 allows remote authenticated users with administrator privileges to write specific files containing non-sensitive information via unspecified vectors."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-03T13:35:35.893Z",
        "orgId": "db201096-a0cc-46c7-9a55-61d9e221bf01",
        "shortName": "synology"
      },
      "references": [
        {
          "name": "Release note",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.synology.com/en-global/releaseNote/HyperBackup?model=DS224%2B\u0026os=DSM\u0026version=7_x_series"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "db201096-a0cc-46c7-9a55-61d9e221bf01",
    "assignerShortName": "synology",
    "cveId": "CVE-2024-47263",
    "datePublished": "2026-06-03T13:35:35.893Z",
    "dateReserved": "2024-09-24T03:58:57.132Z",
    "dateUpdated": "2026-06-03T15:49:29.116Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2023-52951 (GCVE-0-2023-52951)

    Vulnerability from nvd – Published: 2026-06-03 13:11 – Updated: 2026-06-03 15:44
    VLAI
    Summary
    A cleartext transmission of sensitive information vulnerability in Synology Note Station Client before 2.2.4-703 allows man-in-the-middle attackers to obtain user credential.
    Severity
    5.9 (Medium)
    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-06-03 15:44 UTC
    CWE
    • CWE-319 - Cleartext Transmission of Sensitive Information
    Assigner
    References
    Impacted products
    Vendor Product Version
    Synology Synology Note Station Client Affected: * , < 2.2.4-703 (semver)
    		Create a notification for this product.
    Credits
    Zhao Runzi (赵润梓)
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-52951",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-03T15:44:15.548477Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-03T15:44:24.852Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Synology Note Station Client",
          "vendor": "Synology",
          "versions": [
            {
              "lessThan": "2.2.4-703",
              "status": "affected",
              "version": "*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Zhao Runzi (\u8d75\u6da6\u6893)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A cleartext transmission of sensitive information vulnerability in Synology Note Station Client before 2.2.4-703 allows man-in-the-middle attackers to obtain user credential."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-319",
              "description": "Cleartext Transmission of Sensitive Information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-03T13:11:43.564Z",
        "orgId": "db201096-a0cc-46c7-9a55-61d9e221bf01",
        "shortName": "synology"
      },
      "references": [
        {
          "name": "Release note",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.synology.com/en-global/releaseNote/NoteStationClient"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "db201096-a0cc-46c7-9a55-61d9e221bf01",
    "assignerShortName": "synology",
    "cveId": "CVE-2023-52951",
    "datePublished": "2026-06-03T13:11:43.564Z",
    "dateReserved": "2024-09-24T08:35:52.122Z",
    "dateUpdated": "2026-06-03T15:44:24.852Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2022-49042 (GCVE-0-2022-49042)

    Vulnerability from nvd – Published: 2026-06-03 13:23 – Updated: 2026-06-03 15:49
    VLAI
    Summary
    An inclusion of functionality from untrusted control sphere vulnerability in MinGW DLL component in Synology Hyper Backup Explorer before 3.0.1-0156 allows local users to execute arbitrary code via unspecified vectors.
    Severity
    7.8 (High)
    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-06-03 15:49 UTC
    CWE
    • CWE-829 - Inclusion of Functionality from Untrusted Control Sphere
    Assigner
    References
    Impacted products
    Vendor Product Version
    Synology Synology Hyper Backup Explorer Affected: * , < 3.0.1-0156 (semver)
    		Create a notification for this product.
    Credits
    Zhao Runzi (赵润梓)
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-49042",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-03T15:49:42.452454Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-03T15:49:49.115Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Synology Hyper Backup Explorer",
          "vendor": "Synology",
          "versions": [
            {
              "lessThan": "3.0.1-0156",
              "status": "affected",
              "version": "*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Zhao Runzi (\u8d75\u6da6\u6893)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An inclusion of functionality from untrusted control sphere vulnerability in MinGW DLL component in Synology Hyper Backup Explorer before 3.0.1-0156 allows local users to execute arbitrary code via unspecified vectors."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-829",
              "description": "Inclusion of Functionality from Untrusted Control Sphere",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-03T13:23:29.734Z",
        "orgId": "db201096-a0cc-46c7-9a55-61d9e221bf01",
        "shortName": "synology"
      },
      "references": [
        {
          "name": "Release note",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.synology.com/en-global/releaseNote/HyperBackupExplorer"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "db201096-a0cc-46c7-9a55-61d9e221bf01",
    "assignerShortName": "synology",
    "cveId": "CVE-2022-49042",
    "datePublished": "2026-06-03T13:23:29.734Z",
    "dateReserved": "2024-09-24T08:40:22.264Z",
    "dateUpdated": "2026-06-03T15:49:49.115Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2022-49036 (GCVE-0-2022-49036)

    Vulnerability from nvd – Published: 2026-06-03 13:26 – Updated: 2026-06-03 15:50
    VLAI
    Summary
    An inclusion of functionality from untrusted control sphere vulnerability in OpenSSL configuration in Synology Active Backup for Business Recovery Media Creator before 2.5.0-2081 allows local users to execute arbitrary code via unspecified vectors.
    Severity
    7.8 (High)
    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-06-03 15:50 UTC
    CWE
    • CWE-829 - Inclusion of Functionality from Untrusted Control Sphere
    Assigner
    References
    Impacted products
    Credits
    Zhao Runzi (赵润梓)
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-49036",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-03T15:50:00.955014Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-03T15:50:14.277Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Synology Active Backup for Business Recovery Media Creator",
          "vendor": "Synology",
          "versions": [
            {
              "lessThan": "2.5.0-2081",
              "status": "affected",
              "version": "*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Zhao Runzi (\u8d75\u6da6\u6893)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An inclusion of functionality from untrusted control sphere vulnerability in OpenSSL configuration in Synology Active Backup for Business Recovery Media Creator before 2.5.0-2081 allows local users to execute arbitrary code via unspecified vectors."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-829",
              "description": "Inclusion of Functionality from Untrusted Control Sphere",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-03T13:26:18.112Z",
        "orgId": "db201096-a0cc-46c7-9a55-61d9e221bf01",
        "shortName": "synology"
      },
      "references": [
        {
          "name": "Release note",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.synology.com/en-global/releaseNote/ActiveBackupRecoveryMediaCreator"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "db201096-a0cc-46c7-9a55-61d9e221bf01",
    "assignerShortName": "synology",
    "cveId": "CVE-2022-49036",
    "datePublished": "2026-06-03T13:26:18.112Z",
    "dateReserved": "2024-09-24T08:40:22.263Z",
    "dateUpdated": "2026-06-03T15:50:14.277Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-2237 (GCVE-0-2026-2237)

    Vulnerability from nvd – Published: 2026-05-27 08:44 – Updated: 2026-06-02 08:28
    VLAI
    Summary
    A use of get request method with sensitive query strings vulnerability in volume encryption of Synology Storage Manager package before 1.0.1-1100 allows local users on Windows to obtain sensitive information.
    Severity
    6.2 (Medium)
    CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-05-27 12:12 UTC
    CWE
    • CWE-598 - Use of GET Request Method With Sensitive Query Strings
    Assigner
    References
    Impacted products
    Vendor Product Version
    Synology Storage Manager Affected: * , < 1.0.1-1100 (semver)
    		Create a notification for this product.
    Credits
    Simon Baaske (Serviceware)
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-2237",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-27T12:12:11.329662Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-27T12:12:26.271Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Storage Manager",
          "vendor": "Synology",
          "versions": [
            {
              "lessThan": "1.0.1-1100",
              "status": "affected",
              "version": "*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Simon Baaske (Serviceware)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A use of get request method with sensitive query strings vulnerability in volume encryption of Synology Storage Manager package before 1.0.1-1100 allows local users on Windows to obtain sensitive information."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-598",
              "description": "Use of GET Request Method With Sensitive Query Strings",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-02T08:28:36.196Z",
        "orgId": "db201096-a0cc-46c7-9a55-61d9e221bf01",
        "shortName": "synology"
      },
      "references": [
        {
          "name": "Synology-SA-26:01 Storage Manager",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.synology.com/en-global/security/advisory/Synology_SA_26_01"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "db201096-a0cc-46c7-9a55-61d9e221bf01",
    "assignerShortName": "synology",
    "cveId": "CVE-2026-2237",
    "datePublished": "2026-05-27T08:44:29.472Z",
    "dateReserved": "2026-02-09T06:21:48.344Z",
    "dateUpdated": "2026-06-02T08:28:36.196Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2025-66593 (GCVE-0-2025-66593)

    Vulnerability from nvd – Published: 2026-05-27 08:43 – Updated: 2026-06-02 08:21
    VLAI
    Summary
    An origin validation error vulnerability in Synology Assistant before 7.0.6-50085 allows local users to write arbitrary files with restricted content and conduct denial-of-service during installation.
    Severity
    6.1 (Medium)
    CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-05-27 12:14 UTC
    CWE
    • CWE-346 - Origin Validation Error
    Assigner
    References
    Impacted products
    Vendor Product Version
    Synology Synology Assistant Affected: * , < 7.0.6-50085 (semver)
    		Create a notification for this product.
    Credits
    Sheikh Rishad (https://x.com/sheikhrishad0)
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-66593",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-27T12:14:21.119490Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-27T12:15:15.534Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Synology Assistant",
          "vendor": "Synology",
          "versions": [
            {
              "lessThan": "7.0.6-50085",
              "status": "affected",
              "version": "*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Sheikh Rishad (https://x.com/sheikhrishad0)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An origin validation error vulnerability in Synology Assistant before 7.0.6-50085 allows local users to write arbitrary files with restricted content and conduct denial-of-service during installation."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-346",
              "description": "Origin Validation Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-02T08:21:55.359Z",
        "orgId": "db201096-a0cc-46c7-9a55-61d9e221bf01",
        "shortName": "synology"
      },
      "references": [
        {
          "name": "Synology-SA-25:17 Synology Assistant",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.synology.com/en-global/security/advisory/Synology_SA_25_17"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "db201096-a0cc-46c7-9a55-61d9e221bf01",
    "assignerShortName": "synology",
    "cveId": "CVE-2025-66593",
    "datePublished": "2026-05-27T08:43:51.162Z",
    "dateReserved": "2025-12-05T03:19:16.761Z",
    "dateUpdated": "2026-06-02T08:21:55.359Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2025-66592 (GCVE-0-2025-66592)

    Vulnerability from nvd – Published: 2026-05-27 08:43 – Updated: 2026-06-02 08:20
    VLAI
    Summary
    An origin validation error vulnerability in Synology Active Backup for Business Agent before 3.1.0-4967 allows local users to write arbitrary files with restricted content and conduct denial-of-service during installation.
    Severity
    6.1 (Medium)
    CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-05-27 12:39 UTC
    CWE
    • CWE-346 - Origin Validation Error
    Assigner
    References
    Impacted products
    Vendor Product Version
    Synology Synology Active Backup for Business Agent Affected: * , < 3.1.0-4967 (semver)
    		Create a notification for this product.
    Credits
    Sheikh Rishad (https://x.com/sheikhrishad0)
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-66592",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-27T12:39:53.418053Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-27T12:40:03.500Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Synology Active Backup for Business Agent",
          "vendor": "Synology",
          "versions": [
            {
              "lessThan": "3.1.0-4967",
              "status": "affected",
              "version": "*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Sheikh Rishad (https://x.com/sheikhrishad0)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An origin validation error vulnerability in Synology Active Backup for Business Agent before 3.1.0-4967 allows local users to write arbitrary files with restricted content and conduct denial-of-service during installation."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-346",
              "description": "Origin Validation Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-02T08:20:25.069Z",
        "orgId": "db201096-a0cc-46c7-9a55-61d9e221bf01",
        "shortName": "synology"
      },
      "references": [
        {
          "name": "Synology-SA-25:16 Synology Active Backup for Business Agent",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.synology.com/en-global/security/advisory/Synology_SA_25_16"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "db201096-a0cc-46c7-9a55-61d9e221bf01",
    "assignerShortName": "synology",
    "cveId": "CVE-2025-66592",
    "datePublished": "2026-05-27T08:43:05.069Z",
    "dateReserved": "2025-12-05T03:19:16.760Z",
    "dateUpdated": "2026-06-02T08:20:25.069Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2025-30028 (GCVE-0-2025-30028)

    Vulnerability from nvd – Published: 2026-05-27 08:40 – Updated: 2026-05-27 12:43
    VLAI
    Summary
    A vulnerability in Active Backup for Business allows unauthorized remote attackers to read arbitrary files.
    Severity
    8.6 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
    SSVC
    Exploitation: none Automatable: yes Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-05-27 12:43 UTC
    CWE
    • CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
    Assigner
    References
    Impacted products
    Vendor Product Version
    Synology Active Backup for Business Affected: * , < 2.7.1-3234 (semver)
    Affected: * , < 2.7.1-13234 (semver)
    Affected: * , < 2.7.1-23234 (semver)
    		Create a notification for this product.
    Credits
    PSIRT
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-30028",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-27T12:43:34.045527Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-27T12:43:49.263Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Active Backup for Business",
          "vendor": "Synology",
          "versions": [
            {
              "lessThan": "2.7.1-3234",
              "status": "affected",
              "version": "*",
              "versionType": "semver"
            },
            {
              "lessThan": "2.7.1-13234",
              "status": "affected",
              "version": "*",
              "versionType": "semver"
            },
            {
              "lessThan": "2.7.1-23234",
              "status": "affected",
              "version": "*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "PSIRT"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in Active Backup for Business allows unauthorized remote attackers to read arbitrary files."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-27T08:40:46.699Z",
        "orgId": "db201096-a0cc-46c7-9a55-61d9e221bf01",
        "shortName": "synology"
      },
      "references": [
        {
          "name": "Synology-SA-25:02 Active Backup for Business",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.synology.com/en-global/security/advisory/Synology_SA_25_02"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "db201096-a0cc-46c7-9a55-61d9e221bf01",
    "assignerShortName": "synology",
    "cveId": "CVE-2025-30028",
    "datePublished": "2026-05-27T08:40:46.699Z",
    "dateReserved": "2025-03-14T08:18:10.204Z",
    "dateUpdated": "2026-05-27T12:43:49.263Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2025-14713 (GCVE-0-2025-14713)

    Vulnerability from nvd – Published: 2026-05-27 08:39 – Updated: 2026-05-27 12:48
    VLAI
    Summary
    An Exposed Dangerous Method or Function vulnerability in Synology C2 Identity Edge Server package in DSM before 1.76.0-0307 allows remote attackers to obtain user credentials from the edge server.
    Severity
    7.5 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    SSVC
    Exploitation: none Automatable: yes Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-05-27 12:47 UTC
    CWE
    • CWE-749 - Exposed Dangerous Method or Function
    Assigner
    References
    Impacted products
    Vendor Product Version
    Synology C2 Identity Edge Server Affected: * , < 1.76.0-0307 (semver)
    		Create a notification for this product.
    Credits
    Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam)
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-14713",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-27T12:47:29.382845Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-27T12:48:14.986Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "C2 Identity Edge Server",
          "vendor": "Synology",
          "versions": [
            {
              "lessThan": "1.76.0-0307",
              "status": "affected",
              "version": "*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An Exposed Dangerous Method or Function vulnerability in Synology C2 Identity Edge Server package in DSM before 1.76.0-0307 allows remote attackers to obtain user credentials from the edge server."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-749",
              "description": "Exposed Dangerous Method or Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-27T08:39:35.762Z",
        "orgId": "db201096-a0cc-46c7-9a55-61d9e221bf01",
        "shortName": "synology"
      },
      "references": [
        {
          "name": "Synology-SA-25:18 C2 Identity Edge Server (PWN2OWN 2025)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.synology.com/en-global/security/advisory/Synology_SA_25_18"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "db201096-a0cc-46c7-9a55-61d9e221bf01",
    "assignerShortName": "synology",
    "cveId": "CVE-2025-14713",
    "datePublished": "2026-05-27T08:39:35.762Z",
    "dateReserved": "2025-12-15T06:27:33.147Z",
    "dateUpdated": "2026-05-27T12:48:14.986Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2025-13593 (GCVE-0-2025-13593)

    Vulnerability from nvd – Published: 2026-05-27 08:38 – Updated: 2026-06-02 08:18
    VLAI
    Summary
    Origin validation error vulnerability in Synology ActiveProtect Agent before 1.1.0-0439 allows local users to write arbitrary files with restricted content and conduct denial-of-service during installation.
    Severity
    6.1 (Medium)
    CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-05-27 12:48 UTC
    CWE
    • CWE-346 - Origin Validation Error
    Assigner
    References
    Impacted products
    Vendor Product Version
    Synology ActiveProtect Agent Affected: * , < 1.1.0-0439 (semver)
    		Create a notification for this product.
    Credits
    Sheikh Rishad (https://x.com/sheikhrishad0)
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-13593",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-27T12:48:57.300492Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-27T12:50:15.842Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "ActiveProtect Agent",
          "vendor": "Synology",
          "versions": [
            {
              "lessThan": "1.1.0-0439",
              "status": "affected",
              "version": "*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Sheikh Rishad (https://x.com/sheikhrishad0)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Origin validation error vulnerability in Synology ActiveProtect Agent before 1.1.0-0439 allows local users to write arbitrary files with restricted content and conduct denial-of-service during installation."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-346",
              "description": "Origin Validation Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-02T08:18:36.204Z",
        "orgId": "db201096-a0cc-46c7-9a55-61d9e221bf01",
        "shortName": "synology"
      },
      "references": [
        {
          "name": "Synology-SA-25:15 ActiveProtect Agent",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.synology.com/en-global/security/advisory/Synology_SA_25_15"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "db201096-a0cc-46c7-9a55-61d9e221bf01",
    "assignerShortName": "synology",
    "cveId": "CVE-2025-13593",
    "datePublished": "2026-05-27T08:38:27.318Z",
    "dateReserved": "2025-11-24T06:58:48.721Z",
    "dateUpdated": "2026-06-02T08:18:36.204Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2025-13392 (GCVE-0-2025-13392)

    Vulnerability from nvd – Published: 2026-05-27 08:36 – Updated: 2026-05-27 13:44
    VLAI
    Summary
    Improper check for unusual or exceptional conditions vulnerability in SSO in Synology DiskStation Manager (DSM) before 7.2.2-72806-5 and 7.3.1-86003-1 (7.2.1-69057 is not affected) allows remote attackers to bypass authentication with prior knowledge of the distinguished name (DN).
    Severity
    8.1 (High)
    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-05-27 13:44 UTC
    CWE
    • CWE-754 - Improper Check for Unusual or Exceptional Conditions
    Assigner
    References
    Impacted products
    Vendor Product Version
    Synology DiskStation Manager (DSM) Affected: 7.3 , < 7.3.1-86003-1 (semver)
    Affected: 7.2.2 , < 7.2.2-72806-5 (semver)
    Unaffected: 7.2.1 , < 7.2.1.* (semver)
    Unknown: 0 , < 7.2.1 (semver)
    		Create a notification for this product.
    Credits
    Le Trong Phuc (chanze@VRC) and Cao Ngoc Quy (Chino Kafuu)
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-13392",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-27T13:44:25.310637Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-27T13:44:34.268Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "DiskStation Manager (DSM)",
          "vendor": "Synology",
          "versions": [
            {
              "lessThan": "7.3.1-86003-1",
              "status": "affected",
              "version": "7.3",
              "versionType": "semver"
            },
            {
              "lessThan": "7.2.2-72806-5",
              "status": "affected",
              "version": "7.2.2",
              "versionType": "semver"
            },
            {
              "lessThan": "7.2.1.*",
              "status": "unaffected",
              "version": "7.2.1",
              "versionType": "semver"
            },
            {
              "lessThan": "7.2.1",
              "status": "unknown",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Le Trong Phuc (chanze@VRC) and Cao Ngoc Quy (Chino Kafuu)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Improper check for unusual or exceptional conditions vulnerability in SSO in Synology DiskStation Manager (DSM) before 7.2.2-72806-5 and 7.3.1-86003-1 (7.2.1-69057 is not affected) allows remote attackers to bypass authentication with prior knowledge of the distinguished name (DN)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-754",
              "description": "Improper Check for Unusual or Exceptional Conditions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-27T08:36:06.463Z",
        "orgId": "db201096-a0cc-46c7-9a55-61d9e221bf01",
        "shortName": "synology"
      },
      "references": [
        {
          "name": "Synology-SA-25:14 DSM (PWN2OWN 2025)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.synology.com/en-global/security/advisory/Synology_SA_25_14"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "db201096-a0cc-46c7-9a55-61d9e221bf01",
    "assignerShortName": "synology",
    "cveId": "CVE-2025-13392",
    "datePublished": "2026-05-27T08:36:06.463Z",
    "dateReserved": "2025-11-19T00:37:57.748Z",
    "dateUpdated": "2026-05-27T13:44:34.268Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-9548 (GCVE-0-2026-9548)

    Vulnerability from cvelistv5 – Published: 2026-08-28 07:08 – Updated: 2026-08-28 11:03
    VLAI
    Summary
    An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in extract domain in Synology Chat Server before 2.4.5-22148 allows remote authenticated users, via a UI interaction, to read or write restricted files and conduct limited denial-of-service attacks in DSM.
    Severity
    6.5 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-28 11:02 UTC
    CWE
    • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    Assigner
    References
    Impacted products
    Vendor Product Version
    Synology Synology Chat Server Affected: * , < 2.4.5-22148 (semver)
    		Create a notification for this product.
    Credits
    Warisse Valentin (Aytio)
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-9548",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-28T11:02:23.550934Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-28T11:03:02.420Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Synology Chat Server",
          "vendor": "Synology",
          "versions": [
            {
              "lessThan": "2.4.5-22148",
              "status": "affected",
              "version": "*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Warisse Valentin (Aytio)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An improper neutralization of input during web page generation (\u0027Cross-site Scripting\u0027) vulnerability in extract domain in Synology Chat Server before 2.4.5-22148 allows remote authenticated users, via a UI interaction, to read or write restricted files and conduct limited denial-of-service attacks in DSM."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-28T07:08:51.584Z",
        "orgId": "db201096-a0cc-46c7-9a55-61d9e221bf01",
        "shortName": "synology"
      },
      "references": [
        {
          "name": "Synology-SA-26:10 Synology Chat Server",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.synology.com/en-global/security/advisory/Synology_SA_26_10"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "db201096-a0cc-46c7-9a55-61d9e221bf01",
    "assignerShortName": "synology",
    "cveId": "CVE-2026-9548",
    "datePublished": "2026-08-28T07:08:51.584Z",
    "dateReserved": "2026-05-26T07:01:48.490Z",
    "dateUpdated": "2026-08-28T11:03:02.420Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-9491 (GCVE-0-2026-9491)

    Vulnerability from cvelistv5 – Published: 2026-08-28 07:07 – Updated: 2026-08-28 11:03
    VLAI
    Summary
    A server-ide request forgery (SSRF) vulnerability in webhook in Synology Chat Server before 2.4.5-22148 allows remote authenticated users to obtain non-sensitive information.
    Severity
    4.3 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-28 11:03 UTC
    CWE
    • CWE-918 - Server-Side Request Forgery (SSRF)
    Assigner
    References
    Impacted products
    Vendor Product Version
    Synology Synology Chat Server Affected: * , < 2.4.5-22148 (semver)
    		Create a notification for this product.
    Credits
    Lam Jun Rong and Javier Koh, Cyber Specialists of the Digital and Intelligence Service (DIS) working with the Centre for Strategic Infocomm Technologies (CSIT) and Dr Joseph Teo, CSIT
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-9491",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-28T11:03:41.176635Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-28T11:03:53.629Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Synology Chat Server",
          "vendor": "Synology",
          "versions": [
            {
              "lessThan": "2.4.5-22148",
              "status": "affected",
              "version": "*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Lam Jun Rong and Javier Koh, Cyber Specialists of the Digital and Intelligence Service (DIS) working with the Centre for Strategic Infocomm Technologies (CSIT) and Dr Joseph Teo, CSIT"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A server-ide request forgery (SSRF) vulnerability in webhook in Synology Chat Server before 2.4.5-22148 allows remote authenticated users to obtain non-sensitive information."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-28T07:07:57.240Z",
        "orgId": "db201096-a0cc-46c7-9a55-61d9e221bf01",
        "shortName": "synology"
      },
      "references": [
        {
          "name": "Synology-SA-26:10 Synology Chat Server",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.synology.com/en-global/security/advisory/Synology_SA_26_10"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "db201096-a0cc-46c7-9a55-61d9e221bf01",
    "assignerShortName": "synology",
    "cveId": "CVE-2026-9491",
    "datePublished": "2026-08-28T07:07:57.240Z",
    "dateReserved": "2026-05-25T02:03:55.583Z",
    "dateUpdated": "2026-08-28T11:03:53.629Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-40541 (GCVE-0-2026-40541)

    Vulnerability from cvelistv5 – Published: 2026-08-28 07:07 – Updated: 2026-08-28 11:44
    VLAI
    Summary
    An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in extract domain in Synology Chat Server before 2.4.5-22148 allows remote authenticated users, via a UI interaction, to read or write arbitrary files and conduct denial-of-service attacks in DSM.
    Severity
    9 (Critical)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-28 11:31 UTC
    CWE
    • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    Assigner
    References
    Impacted products
    Vendor Product Version
    Synology Synology Chat Server Affected: * , < 2.4.5-22148 (semver)
    		Create a notification for this product.
    Credits
    Lam Jun Rong and Javier Koh, Cyber Specialists of the Digital and Intelligence Service (DIS) working with the Centre for Strategic Infocomm Technologies (CSIT) and Dr Joseph Teo, CSIT
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-40541",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-28T11:31:57.261097Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-28T11:44:42.311Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Synology Chat Server",
          "vendor": "Synology",
          "versions": [
            {
              "lessThan": "2.4.5-22148",
              "status": "affected",
              "version": "*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Lam Jun Rong and Javier Koh, Cyber Specialists of the Digital and Intelligence Service (DIS) working with the Centre for Strategic Infocomm Technologies (CSIT) and Dr Joseph Teo, CSIT"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An improper neutralization of input during web page generation (\u0027Cross-site Scripting\u0027) vulnerability in extract domain in Synology Chat Server before 2.4.5-22148 allows remote authenticated users, via a UI interaction, to read or write arbitrary files and conduct denial-of-service attacks in DSM."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-28T07:07:24.049Z",
        "orgId": "db201096-a0cc-46c7-9a55-61d9e221bf01",
        "shortName": "synology"
      },
      "references": [
        {
          "name": "Synology-SA-26:10 Synology Chat Server",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.synology.com/en-global/security/advisory/Synology_SA_26_10"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "db201096-a0cc-46c7-9a55-61d9e221bf01",
    "assignerShortName": "synology",
    "cveId": "CVE-2026-40541",
    "datePublished": "2026-08-28T07:07:24.049Z",
    "dateReserved": "2026-04-14T01:01:14.607Z",
    "dateUpdated": "2026-08-28T11:44:42.311Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-4793 (GCVE-0-2026-4793)

    Vulnerability from cvelistv5 – Published: 2026-08-03 06:00 – Updated: 2026-08-03 14:54
    VLAI
    Summary
    An incorrect default permissions vulnerability in Synology Assistant before 7.0.7-50095 allows local users to read or write arbitrary files and conduct denial-of-service during installation.
    Severity
    7.3 (High)
    CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-03 14:46 UTC
    CWE
    • CWE-276 - Incorrect Default Permissions
    Assigner
    References
    Impacted products
    Vendor Product Version
    Synology Synology Assistant Affected: * , < 7.0.7-50095 (semver)
    		Create a notification for this product.
    Credits
    Kazuma Matsumoto, a security researcher at GMO Cybersecurity by IERAE, Inc.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-4793",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-03T14:46:03.226652Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-03T14:54:10.232Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Synology Assistant",
          "vendor": "Synology",
          "versions": [
            {
              "lessThan": "7.0.7-50095",
              "status": "affected",
              "version": "*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Kazuma Matsumoto, a security researcher at GMO Cybersecurity by IERAE, Inc."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An incorrect default permissions vulnerability in Synology Assistant before 7.0.7-50095 allows local users to read or write arbitrary files and conduct denial-of-service during installation."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-276",
              "description": "Incorrect Default Permissions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-03T06:00:39.179Z",
        "orgId": "db201096-a0cc-46c7-9a55-61d9e221bf01",
        "shortName": "synology"
      },
      "references": [
        {
          "name": "Synology-SA-26:12 Synology Assistant",
          "url": "https://www.synology.com/en-global/security/advisory/Synology_SA_26_12"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "db201096-a0cc-46c7-9a55-61d9e221bf01",
    "assignerShortName": "synology",
    "cveId": "CVE-2026-4793",
    "datePublished": "2026-08-03T06:00:39.179Z",
    "dateReserved": "2026-03-25T00:47:20.775Z",
    "dateUpdated": "2026-08-03T14:54:10.232Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2024-47263 (GCVE-0-2024-47263)

    Vulnerability from cvelistv5 – Published: 2026-06-03 13:35 – Updated: 2026-06-03 15:49
    VLAI
    Summary
    An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in Backup.Repository webapi component in Synology Hyper Backup before 4.1.2-4036 allows remote authenticated users with administrator privileges to write specific files containing non-sensitive information via unspecified vectors.
    Severity
    4.1 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-06-03 15:49 UTC
    CWE
    • CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
    Assigner
    References
    Impacted products
    Vendor Product Version
    Synology Hyper Backup Affected: * , < 4.1.2-4036 (semver)
    		Create a notification for this product.
    Credits
    Zhao Runzi (赵润梓)
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-47263",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-03T15:49:20.857350Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-03T15:49:29.116Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Hyper Backup",
          "vendor": "Synology",
          "versions": [
            {
              "lessThan": "4.1.2-4036",
              "status": "affected",
              "version": "*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Zhao Runzi (\u8d75\u6da6\u6893)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An improper limitation of a pathname to a restricted directory (\u0027Path Traversal\u0027) vulnerability in Backup.Repository webapi component in Synology Hyper Backup before 4.1.2-4036 allows remote authenticated users with administrator privileges to write specific files containing non-sensitive information via unspecified vectors."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-03T13:35:35.893Z",
        "orgId": "db201096-a0cc-46c7-9a55-61d9e221bf01",
        "shortName": "synology"
      },
      "references": [
        {
          "name": "Release note",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.synology.com/en-global/releaseNote/HyperBackup?model=DS224%2B\u0026os=DSM\u0026version=7_x_series"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "db201096-a0cc-46c7-9a55-61d9e221bf01",
    "assignerShortName": "synology",
    "cveId": "CVE-2024-47263",
    "datePublished": "2026-06-03T13:35:35.893Z",
    "dateReserved": "2024-09-24T03:58:57.132Z",
    "dateUpdated": "2026-06-03T15:49:29.116Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2024-47273 (GCVE-0-2024-47273)

    Vulnerability from cvelistv5 – Published: 2026-06-03 13:31 – Updated: 2026-06-03 15:49
    VLAI
    Summary
    An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in Backup Task functionality in Synology Hyper Backup before 4.1.2-4036 allows remote authenticated users to write specific files via unspecified vectors.
    Severity
    4.3 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-06-03 15:49 UTC
    CWE
    • CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
    Assigner
    References
    Impacted products
    Vendor Product Version
    Synology Hyper Backup Affected: * , < 4.1.2-4036 (semver)
    		Create a notification for this product.
    Credits
    Zhao Runzi (赵润梓)
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-47273",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-03T15:49:00.291601Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-03T15:49:08.289Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Hyper Backup",
          "vendor": "Synology",
          "versions": [
            {
              "lessThan": "4.1.2-4036",
              "status": "affected",
              "version": "*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Zhao Runzi (\u8d75\u6da6\u6893)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An improper limitation of a pathname to a restricted directory (\u0027Path Traversal\u0027) vulnerability in Backup Task functionality in Synology Hyper Backup before 4.1.2-4036 allows remote authenticated users to write specific files via unspecified vectors."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-03T13:31:24.351Z",
        "orgId": "db201096-a0cc-46c7-9a55-61d9e221bf01",
        "shortName": "synology"
      },
      "references": [
        {
          "name": "Release note",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.synology.com/en-global/releaseNote/HyperBackup?model=DS224%2B\u0026os=DSM\u0026version=7_x_series"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "db201096-a0cc-46c7-9a55-61d9e221bf01",
    "assignerShortName": "synology",
    "cveId": "CVE-2024-47273",
    "datePublished": "2026-06-03T13:31:24.351Z",
    "dateReserved": "2024-09-24T03:58:57.133Z",
    "dateUpdated": "2026-06-03T15:49:08.289Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2022-49036 (GCVE-0-2022-49036)

    Vulnerability from cvelistv5 – Published: 2026-06-03 13:26 – Updated: 2026-06-03 15:50
    VLAI
    Summary
    An inclusion of functionality from untrusted control sphere vulnerability in OpenSSL configuration in Synology Active Backup for Business Recovery Media Creator before 2.5.0-2081 allows local users to execute arbitrary code via unspecified vectors.
    Severity
    7.8 (High)
    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-06-03 15:50 UTC
    CWE
    • CWE-829 - Inclusion of Functionality from Untrusted Control Sphere
    Assigner
    References
    Impacted products
    Credits
    Zhao Runzi (赵润梓)
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-49036",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-03T15:50:00.955014Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-03T15:50:14.277Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Synology Active Backup for Business Recovery Media Creator",
          "vendor": "Synology",
          "versions": [
            {
              "lessThan": "2.5.0-2081",
              "status": "affected",
              "version": "*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Zhao Runzi (\u8d75\u6da6\u6893)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An inclusion of functionality from untrusted control sphere vulnerability in OpenSSL configuration in Synology Active Backup for Business Recovery Media Creator before 2.5.0-2081 allows local users to execute arbitrary code via unspecified vectors."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-829",
              "description": "Inclusion of Functionality from Untrusted Control Sphere",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-03T13:26:18.112Z",
        "orgId": "db201096-a0cc-46c7-9a55-61d9e221bf01",
        "shortName": "synology"
      },
      "references": [
        {
          "name": "Release note",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.synology.com/en-global/releaseNote/ActiveBackupRecoveryMediaCreator"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "db201096-a0cc-46c7-9a55-61d9e221bf01",
    "assignerShortName": "synology",
    "cveId": "CVE-2022-49036",
    "datePublished": "2026-06-03T13:26:18.112Z",
    "dateReserved": "2024-09-24T08:40:22.263Z",
    "dateUpdated": "2026-06-03T15:50:14.277Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2022-49042 (GCVE-0-2022-49042)

    Vulnerability from cvelistv5 – Published: 2026-06-03 13:23 – Updated: 2026-06-03 15:49
    VLAI
    Summary
    An inclusion of functionality from untrusted control sphere vulnerability in MinGW DLL component in Synology Hyper Backup Explorer before 3.0.1-0156 allows local users to execute arbitrary code via unspecified vectors.
    Severity
    7.8 (High)
    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-06-03 15:49 UTC
    CWE
    • CWE-829 - Inclusion of Functionality from Untrusted Control Sphere
    Assigner
    References
    Impacted products
    Vendor Product Version
    Synology Synology Hyper Backup Explorer Affected: * , < 3.0.1-0156 (semver)
    		Create a notification for this product.
    Credits
    Zhao Runzi (赵润梓)
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-49042",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-03T15:49:42.452454Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-03T15:49:49.115Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Synology Hyper Backup Explorer",
          "vendor": "Synology",
          "versions": [
            {
              "lessThan": "3.0.1-0156",
              "status": "affected",
              "version": "*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Zhao Runzi (\u8d75\u6da6\u6893)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An inclusion of functionality from untrusted control sphere vulnerability in MinGW DLL component in Synology Hyper Backup Explorer before 3.0.1-0156 allows local users to execute arbitrary code via unspecified vectors."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-829",
              "description": "Inclusion of Functionality from Untrusted Control Sphere",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-03T13:23:29.734Z",
        "orgId": "db201096-a0cc-46c7-9a55-61d9e221bf01",
        "shortName": "synology"
      },
      "references": [
        {
          "name": "Release note",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.synology.com/en-global/releaseNote/HyperBackupExplorer"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "db201096-a0cc-46c7-9a55-61d9e221bf01",
    "assignerShortName": "synology",
    "cveId": "CVE-2022-49042",
    "datePublished": "2026-06-03T13:23:29.734Z",
    "dateReserved": "2024-09-24T08:40:22.264Z",
    "dateUpdated": "2026-06-03T15:49:49.115Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2023-52951 (GCVE-0-2023-52951)

    Vulnerability from cvelistv5 – Published: 2026-06-03 13:11 – Updated: 2026-06-03 15:44
    VLAI
    Summary
    A cleartext transmission of sensitive information vulnerability in Synology Note Station Client before 2.2.4-703 allows man-in-the-middle attackers to obtain user credential.
    Severity
    5.9 (Medium)
    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-06-03 15:44 UTC
    CWE
    • CWE-319 - Cleartext Transmission of Sensitive Information
    Assigner
    References
    Impacted products
    Vendor Product Version
    Synology Synology Note Station Client Affected: * , < 2.2.4-703 (semver)
    		Create a notification for this product.
    Credits
    Zhao Runzi (赵润梓)
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-52951",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-03T15:44:15.548477Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-03T15:44:24.852Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Synology Note Station Client",
          "vendor": "Synology",
          "versions": [
            {
              "lessThan": "2.2.4-703",
              "status": "affected",
              "version": "*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Zhao Runzi (\u8d75\u6da6\u6893)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A cleartext transmission of sensitive information vulnerability in Synology Note Station Client before 2.2.4-703 allows man-in-the-middle attackers to obtain user credential."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-319",
              "description": "Cleartext Transmission of Sensitive Information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-03T13:11:43.564Z",
        "orgId": "db201096-a0cc-46c7-9a55-61d9e221bf01",
        "shortName": "synology"
      },
      "references": [
        {
          "name": "Release note",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.synology.com/en-global/releaseNote/NoteStationClient"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "db201096-a0cc-46c7-9a55-61d9e221bf01",
    "assignerShortName": "synology",
    "cveId": "CVE-2023-52951",
    "datePublished": "2026-06-03T13:11:43.564Z",
    "dateReserved": "2024-09-24T08:35:52.122Z",
    "dateUpdated": "2026-06-03T15:44:24.852Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CERTFR-2026-AVI-0988

    Vulnerability from certfr_avis - Published: 2026-08-10 - Updated: 2026-08-10

    Une vulnérabilité a été découverte dans Synology Assistant. Elle permet à un attaquant de provoquer une atteinte à la confidentialité des données, une atteinte à l'intégrité des données et un déni de service.

    Solutions

    Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

    Impacted products
    Vendor Product Description
    Synology Assistant Assistant versions antérieures à 7.0.7-50095
    References

    Show details on source website
    To clipboard 

    {
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Assistant versions ant\u00e9rieures \u00e0 7.0.7-50095",
      "product": {
        "name": "Assistant",
        "vendor": {
          "name": "Synology",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-4793",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-4793"
    }
  ],
  "initial_release_date": "2026-08-10T00:00:00",
  "last_revision_date": "2026-08-10T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-0988",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-08-10T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "D\u00e9ni de service"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Synology Assistant. Elle permet \u00e0 un attaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es, une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es et un d\u00e9ni de service.",
  "title": "Vuln\u00e9rabilit\u00e9 dans Synology Assistant",
  "vendor_advisories": [
    {
      "published_at": "2026-08-03",
      "title": "Bulletin de s\u00e9curit\u00e9 Synology Synology_SA_26_12",
      "url": "https://www.synology.com/en-global/security/advisory/Synology_SA_26_12"
    }
  ]
}

    CERTFR-2026-AVI-0819

    Vulnerability from certfr_avis - Published: 2026-06-30 - Updated: 2026-06-30

    De multiples vulnérabilités ont été découvertes dans Synology MailPlus Server. Certaines d'entre elles permettent à un attaquant de provoquer un déni de service à distance, une atteinte à la confidentialité des données et une atteinte à l'intégrité des données.

    Solutions

    Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

    Impacted products
    Vendor Product Description
    Synology Mail Server Synology MailPlus Server versions antérieures à 4.0.1-31663 pour DSM 7.3
    Synology Mail Server Synology MailPlus Server versions antérieures à 4.0.1-21663 pour DSM 7.2.1 et 7.2.2
    References

    Show details on source website
    To clipboard 

    {
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Synology MailPlus Server versions ant\u00e9rieures \u00e0 4.0.1-31663 pour DSM 7.3",
      "product": {
        "name": "Mail Server",
        "vendor": {
          "name": "Synology",
          "scada": false
        }
      }
    },
    {
      "description": "Synology MailPlus Server versions ant\u00e9rieures \u00e0 4.0.1-21663 pour DSM 7.2.1 et 7.2.2",
      "product": {
        "name": "Mail Server",
        "vendor": {
          "name": "Synology",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-13135",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13135"
    },
    {
      "name": "CVE-2025-15660",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-15660"
    },
    {
      "name": "CVE-2026-13136",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13136"
    }
  ],
  "initial_release_date": "2026-06-30T00:00:00",
  "last_revision_date": "2026-06-30T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-0819",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-06-30T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Synology MailPlus Server. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Synology MailPlus Server",
  "vendor_advisories": [
    {
      "published_at": "2026-06-26",
      "title": "Bulletin de s\u00e9curit\u00e9 Synology Synology_SA_26_11",
      "url": "https://www.synology.com/en-global/security/advisory/Synology_SA_26_11"
    }
  ]
}

    CERTFR-2026-AVI-0687

    Vulnerability from certfr_avis - Published: 2026-06-04 - Updated: 2026-06-04

    De multiples vulnérabilités ont été découvertes dans Synology Chat Server pour DSM. Certaines d'entre elles permettent à un attaquant de provoquer un déni de service à distance, une atteinte à la confidentialité des données et une atteinte à l'intégrité des données.

    Solutions

    Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

    Impacted products
    Vendor Product Description
    Synology Chat Server pour DSM Chat Server versions antérieures à 2.4.5-22148 pour DSM 7.2.1
    Synology Chat Server pour DSM Chat Server versions antérieures à 2.4.5-22148 pour DSM 7.3
    Synology Chat Server pour DSM Chat Server versions antérieures à 2.4.5-22148 pour DSM 7.2.2
    References

    Show details on source website
    To clipboard 

    {
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Chat Server versions ant\u00e9rieures \u00e0 2.4.5-22148 pour DSM 7.2.1",
      "product": {
        "name": "Chat Server pour DSM",
        "vendor": {
          "name": "Synology",
          "scada": false
        }
      }
    },
    {
      "description": "Chat Server versions ant\u00e9rieures \u00e0 2.4.5-22148 pour DSM 7.3",
      "product": {
        "name": "Chat Server pour DSM",
        "vendor": {
          "name": "Synology",
          "scada": false
        }
      }
    },
    {
      "description": "Chat Server versions ant\u00e9rieures \u00e0 2.4.5-22148 pour DSM 7.2.2",
      "product": {
        "name": "Chat Server pour DSM",
        "vendor": {
          "name": "Synology",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-9491",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-9491"
    },
    {
      "name": "CVE-2026-40541",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-40541"
    },
    {
      "name": "CVE-2026-9548",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-9548"
    }
  ],
  "initial_release_date": "2026-06-04T00:00:00",
  "last_revision_date": "2026-06-04T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-0687",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-06-04T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Falsification de requ\u00eates c\u00f4t\u00e9 serveur (SSRF)"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Synology Chat Server pour DSM. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Synology Chat Server pour DSM",
  "vendor_advisories": [
    {
      "published_at": "2026-05-26",
      "title": "Bulletin de s\u00e9curit\u00e9 Synology Synology_SA_26_10",
      "url": "https://www.synology.com/en-global/security/advisory/Synology_SA_26_10"
    }
  ]
}