CVE-2026-13639
CriticalCVSS 9.8Summary
An insufficient entropy vulnerability in login logic in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks.
Risk Assessment
Weak entropy in the login mechanism may allow prediction of session values or tokens, leading to unauthorized access. This can result in data leakage and disruption of service availability.
Recommendation
Update Synology DSM to version 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, 7.4-90075 or later. Consider enforcing stronger authentication mechanisms and monitoring for unusual login attempts.
Other vulnerabilities in Synology DiskStation Manager (DSM)
See all- CVE-2026-13635Medium
An improper encoding or escaping of output vulnerability in the Auth API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to obtain non-sensitive information.
- CVE-2026-13623Medium
An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in the Theme API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users with administrator privileges to read or write limited files.
- CVE-2017-15889High
A command injection vulnerability in smart.cgi in Synology DiskStation Manager (DSM) before version 5.2-5967-5 allows remote authenticated users to execute arbitrary commands via the disk field.
- CVE-2026-13684Critical
An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks.
Original NVD description (English source)
An insufficient entropy vulnerability in login logic in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks.