CVE-2017-15889
HighSummary
A command injection vulnerability in smart.cgi in Synology DiskStation Manager (DSM) before version 5.2-5967-5 allows remote authenticated users to execute arbitrary commands via the disk field.
Risk Assessment
This vulnerability could lead to unauthorized access to the system and execution of malicious code, posing a serious threat to the organization's data security.
Recommendation
It is recommended to update Synology DiskStation Manager to the latest version to mitigate this vulnerability and restrict access to the management interface to trusted users.
Other vulnerabilities in Synology DiskStation Manager (DSM)
See all- CVE-2026-13635Medium
An improper encoding or escaping of output vulnerability in the Auth API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to obtain non-sensitive information.
- CVE-2026-13623Medium
An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in the Theme API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users with administrator privileges to read or write limited files.
- CVE-2026-13684Critical
An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks.
- CVE-2026-13639Critical
An insufficient entropy vulnerability in login logic in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks.
Original NVD description (English source)
Command injection vulnerability in smart.cgi in Synology DiskStation Manager (DSM) before 5.2-5967-5 allows remote authenticated users to execute arbitrary commands via disk field.