📦

diskstation_manager

Vendor: synology

Login to add this product to WatchStack
Actively Exploited 0 CISA KEV List
PoC / Exploits 6 Code Available
Total RCEs 16 Remote Access
Total CVEs 188 Total Indexed
Avg. EPSS 7.08% Exploit Prob.
Latest CVE CVE-2025-13392 May 27

Security Vulnerability Index

Page 4 / 19
7.8 CVSS
CVE-2021-29088
RCE

Improper limitation of a pathname to a restricted directory ('Path Traversal') in cgi component in Synology DiskStation Manager (DSM) before 6.2.4-25553 allows local users to execute arbitrary code via unspecified vectors.

EPSS: 0.32%
7.2 CVSS
CVE-2021-29083
RCE

Improper neutralization of special elements used in an OS command in SYNO.Core.Network.PPPoE in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote authenticated users to execute arbitrary code via realname parameter.

EPSS: 2.62%
9.8 CVSS
CVE-2021-27647
RCE

Out-of-bounds Read vulnerability in iscsi_snapshot_comm_core in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via crafted web requests.

EPSS: 3.13%
9.8 CVSS
CVE-2021-27646
RCE

Use After Free vulnerability in iscsi_snapshot_comm_core in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via crafted web requests.

EPSS: 3.79%
9.8 CVSS
CVE-2021-26569
RCE

Race Condition within a Thread vulnerability in iscsi_snapshot_comm_core in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via crafted web requests.

EPSS: 2.18%
6.5 CVSS
CVE-2020-27656

Cleartext transmission of sensitive information vulnerability in DDNS in Synology DiskStation Manager (DSM) before 6.2.3-25426-2 allows man-in-the-middle attackers to eavesdrop authentication information of DNSExit via unspecified vectors.

EPSS: 0.54%
5.9 CVSS
CVE-2018-13293

Cross-site scripting (XSS) vulnerability in Control Panel SSO Settings in Synology DiskStation Manager (DSM) before 6.2.1-23824 allows remote authenticated users to inject arbitrary web script or HTML via the URL parameter.

EPSS: 0.80%
4.3 CVSS
CVE-2018-13291

Information exposure vulnerability in /usr/syno/etc/mount.conf in Synology DiskStation Manager (DSM) before 6.2.1-23824 allows remote authenticated users to obtain sensitive information via the world readable configuration.

EPSS: 1.19%
6.5 CVSS
CVE-2018-13286

Incorrect default permissions vulnerability in synouser.conf in Synology Diskstation Manager (DSM) before 6.2-23739-1 allows remote authenticated users to obtain sensitive information via the world readable configuration.

EPSS: 1.31%
7.5 CVSS
CVE-2018-13284
RCE

Command injection vulnerability in ftpd in Synology Diskstation Manager (DSM) before 6.2-23739-1 allows remote authenticated users to execute arbitrary OS commands via the (1) MKD or (2) RMD command.

EPSS: 2.31%