CVE Intelligence

Synology Diskstation Manager vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Synology Diskstation Manager: 5 record(s), with affected versions and fixes.
cpe:2.3:o:synology:diskstation_manager

CVE-2025-13392 Critical · 9.8 CWE-754 May 27, 2026
Improper Check for Unusual or Exceptional Conditions in Synology Diskstation Manager
Improper check for unusual or exceptional conditions vulnerability in SSO in Synology DiskStation Manager (DSM) before 7.2.2-72806-5 and 7.3.1-86003-1 (7.2.1-69057 is not affected) allows remote attackers to bypass authentication with prior knowledge of the distinguished name (DN).
CVE-2024-5401 High · 8.8 CWE-913 Dec 4, 2025
Improper Control of Dynamically-Managed Code Resources in Synology Diskstation Manager
Improper control of dynamically-managed code resources vulnerability in WebAPI component in Synology DiskStation Manager (DSM) before 7.1.1-42962-8 and 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote authenticated users to obtain privileges without consent via unspecified vectors.
CVE-2024-45539 High · 7.5 CWE-787 Dec 4, 2025
Out-of-bounds Write in Synology Diskstation Manager
Out-of-bounds write vulnerability in cgi components in Synology DiskStation Manager (DSM) before 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote attackers to conduct denial-of-service attacks via unspecified vectors.
CVE-2024-45538 Critical · 9.6 CWE-352 Dec 4, 2025
Cross-Site Request Forgery (CSRF) in Synology Diskstation Manager
Cross-Site Request Forgery (CSRF) vulnerability in WebAPI Framework in Synology DiskStation Manager (DSM) before 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote attackers to execute arbitrary code via unspecified vectors.
CVE-2021-3156 High · 7.8 KEV Urgent · 76 Public exploit CWE-193 Jan 26, 2021
Sudo Heap-Based Buffer Overflow Vulnerability
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.