CVE-2026-13639
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
An insufficient entropy vulnerability in login logic in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks.
Risk Assessment
Weak entropy in the login mechanism may allow prediction of session values or tokens, leading to unauthorized access. This can result in data leakage and disruption of service availability.
Recommendation
Update Synology DSM to version 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, 7.4-90075 or later. Consider enforcing stronger authentication mechanisms and monitoring for unusual login attempts.
Other vulnerabilities in Synology DiskStation Manager (DSM)
See all- CVE-2017-15889High
A command injection vulnerability in smart.cgi in Synology DiskStation Manager (DSM) before version 5.2-5967-5 allows remote authenticated users to execute arbitrary commands via the disk field.
- CVE-2026-13684Critical
An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks.
- CVE-2026-13635Medium
An improper encoding or escaping of output vulnerability in the Auth API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to obtain non-sensitive information.
- CVE-2026-13623Medium
An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in the Theme API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users with administrator privileges to read or write limited files.
- CVE-2024-5401Medium
An improper control of dynamically-managed code resources vulnerability in the WebAPI component in Synology DiskStation Manager (DSM) before 7.1.1-42962-8, 7.2.1-69057-2, and 7.2.2-72806 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote authenticated users to obtain privileges without consent via unspecified vectors.
Original NVD description (English source)
An insufficient entropy vulnerability in login logic in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS