Synology vulnerabilities
We track 78 vulnerabilities in Synology products across 47 products. 78 are rated high or critical, and 2 have been exploited in real attacks. The most recent was published on November 12, 2026.
Latest Synology vulnerabilities
- 8.1 High severity
Synology Router Manager (SRM): Improper Limitation of a Pathname to a Restricted Directory
Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in OTP reset functionality in Synology Router Manager (SRM) before 1.3.1-9346-9 allows remote authenticated users to delete arbitrary files via unspecified vectors.
- 9.8 Critical severity
BeePhotos: Improper Neutralization of Special Elements used in a Command
Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in Task Manager component in Synology BeePhotos before 1.0.2-10026 and 1.1.0-10053 and Synology Photos before 1.6.2-0720 and 1.7.0-0795 allows remote attac
- 8.2 High severity
Synology Drive Client: Buffer Copy without Checking Size of Input
Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in vss service component in Synology Drive Client before 3.5.0-16084 allows remote attackers to overwrite trivial buffers and crash the client via unspecified vectors.
- 7.8 High severity
Synology Drive Client: Inclusion of Functionality from Untrusted Control Sphere
Inclusion of functionality from untrusted control sphere vulnerability in OpenSSL DLL component in Synology Drive Client before 3.3.0-15082 allows local users to execute arbitrary code via unspecified vectors.
- 7.5 High severity
Camera Firmware: Authentication Bypass by Spoofing
A vulnerability regarding authentication bypass by spoofing is found in the RTSP functionality. This allows man-in-the-middle attackers to obtain privileges without consent via unspecified vectors. The following models with Synology Camera Firmware versions be
- 7.5 High severity
Synology Router Manager (SRM): Download of Code Without Integrity Check
Download of code without integrity check vulnerability in AirPrint functionality in Synology Router Manager (SRM) before 1.2.5-8227-11 and 1.3.1-9346-8 allows man-in-the-middle attackers to execute arbitrary code via unspecified vectors.
- 7.2 High severity
Camera Firmware: Improper Neutralization of Special Elements used in an OS Command
A vulnerability regarding improper neutralization of special elements used in an OS command ('OS Command Injection') is found in the NTP configuration. This allows remote authenticated users with administrator privileges to execute arbitrary commands via unspe
- 9.8 Critical severity
Camera Firmware: Buffer Copy without Checking Size of Input
A vulnerability regarding buffer copy without checking size of input ('Classic Buffer Overflow') is found in the libjansson component and it does not affect the upstream library. This allows remote attackers to execute arbitrary code via unspecified vectors. T
- 7.2 High severity
Camera Firmware: Improper Neutralization of Special Elements used in an OS Command
A vulnerability regarding improper neutralization of special elements used in an OS command ('OS Command Injection') is found in the IP block functionality. This allows remote authenticated users with administrator privileges to execute arbitrary commands via
- 9.9 Critical severity
Surveillance Station: Missing Authorization
Missing authorization vulnerability in System webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 allows remote authenticated users to obtain non-sensitive information, write sensitive configurations in DSM, and reboot or shutdo
- 7.7 High severity
Surveillance Station: Missing Authorization
Missing authorization vulnerability in GetLiveViewPath webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 allows remote authenticated users to obtain sensitive information via unspecified vectors.
- 7.7 High severity
Surveillance Station: Missing Authorization
Missing authorization vulnerability in GetStmUrlPath webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 allows remote authenticated users to obtain sensitive information via unspecified vectors.
- 9.8 Critical severity
Camera Firmware: Use of Externally-Controlled Format String
A vulnerability regarding use of externally-controlled format string is found in the cgi component. This allows remote attackers to execute arbitrary code via unspecified vectors. The following models with Synology Camera Firmware versions before 1.0.5-0185 ma
- 8.1 High severity
DiskStation Manager (DSM): Uncontrolled Search Path Element
Uncontrolled search path element vulnerability in Backup Management functionality in Synology DiskStation Manager (DSM) before 6.2.4-25556-8, 7.0.1-42218-7 and 7.1-42661 allows remote authenticated users with administrator privileges to read or write arbitrary
- 8.8 High severity
Presto File Server: Improper Privilege Management
Improper privilege management vulnerability in summary report management in Synology Presto File Server before 2.1.2-1601 allows remote authenticated users to bypass security constraint via unspecified vectors.
- 7.5 High severity
Presto File Server: Improper Limitation of a Pathname to a Restricted Directory
Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in file operation management in Synology Presto File Server before 2.1.2-1601 allows remote attackers to write arbitrary files via unspecified vectors.
- 9.1 Critical severity
DiskStation Manager (DSM): Missing Authentication for Critical Functionality
Missing authentication for critical function vulnerability in iSCSI management functionality in Synology DiskStation Manager (DSM) before 7.1-42661 allows remote attackers to read or write arbitrary files via unspecified vectors.
- 7.5 High severity
DiskStation Manager (DSM): Out-of-bounds Read
A vulnerability regarding out-of-bounds read is found in the session processing functionality of Out-of-Band (OOB) Management. This allows remote attackers to obtain sensitive information via unspecified vectors. The following models with Synology DiskStation
- 8.1 High severity
DiskStation Manager (DSM): Concurrent Execution using Shared Resource with Improper Synchronization
A vulnerability regarding concurrent execution using shared resource with improper synchronization ('Race Condition') is found in the session processing functionality of Out-of-Band (OOB) Management. This allows remote attackers to execute arbitrary commands v
- 9.8 Critical severity
DiskStation Manager (DSM): Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the message processing functionality of Out-of-Band (OOB) Management. This allows remote attackers to execute arbitrary commands via unspecified vecto
- 9.8 Critical severity
DiskStation Manager (DSM): Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the packet decryption functionality of Out-of-Band (OOB) Management. This allows remote attackers to execute arbitrary commands via unspecified vector
- 7.2 High severity
DiskStation Manager (DSM): Improper Neutralization of Special Elements used in an OS Command
Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in webapi component in Synology DiskStation Manager (DSM) before 7.0.1-42218-3 allows remote authenticated users to execute arbitrary commands via unspecif
- 8.1 High severity
Audio Station: Improper Limitation of a Pathname to a Restricted Directory
Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology Audio Station before 6.5.4-3367 allows remote authenticated users to delete arbitrary files via unspecified vectors.
- 7.5 High severity
Media Server: Exposure of Sensitive Information to an Unauthorized Actor
Exposure of sensitive information to an unauthorized actor vulnerability in web server in Synology Media Server before 1.8.1-2876 allows remote attackers to obtain sensitive information via unspecified vectors.
- 8.8 High severity
CardDAV Server: Improper Neutralization of Special Elements used in an SQL Command
Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in webapi component in Synology CardDAV Server before 6.0.10-0153 allows remote authenticated users to inject SQL commands via unspecified vectors.
- 9.8 Critical severity
Audio Station: Buffer Copy without Checking Size of Input
Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in cgi component in Synology Audio Station before 6.5.4-3367 allows remote attackers to execute arbitrary commands via unspecified vectors.
- 8.1 High severity
WebDAV Server: Improper Limitation of a Pathname to a Restricted Directory
Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology WebDAV Server before 2.4.0-0062 allows remote authenticated users to delete arbitrary files via unspecified vectors.
- 8.8 High severity
DiskStation Manager (DSM): Improper Neutralization of Special Elements used in an OS Command
Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in task management component in Synology DiskStation Manager (DSM) before 6.2.4-25553 allows remote authenticated users to execute arbitrary commands via u
- 9.8 Critical severity
Media Server: Buffer Copy without Checking Size of Input
Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in cgi component in Synology Media Server before 1.8.1-2876 allows remote attackers to execute arbitrary code via unspecified vectors.
- 8.1 High severity
DNS Server: Improper Limitation of a Pathname to a Restricted Directory
Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in cgi component in Synology DNS Server before 2.2.2-5027 allows remote authenticated users to delete arbitrary files via unspecified vectors.
- 8.1 High severity
DiskStation Manager (DSM): Improper Limitation of a Pathname to a Restricted Directory
Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology DiskStation Manager (DSM) before 6.2.3-25423 allows remote authenticated users to delete arbitrary files via unspecified vectors.
- 8.0 High severity
Synology Calendar: Cross-Site Request Forgery
Cross-Site Request Forgery (CSRF) vulnerability in webapi component in Synology Calendar before 2.3.4-0631 allows remote authenticated users to hijack the authentication of administrators via unspecified vectors.
- 7.5 High severity
Photo Station: Session Fixation
Session fixation vulnerability in access control management in Synology Photo Station before 6.8.16-3506 allows remote attackers to bypass security constraint via unspecified vectors.
- 8.8 High severity
DiskStation Manager (DSM): Improper Neutralization of Special Elements used in a Command
Improper neutralization of special elements used in a command ('Command Injection') vulnerability in File service functionality in Synology DiskStation Manager (DSM) before 6.2.4-25556-2 allows remote authenticated users to execute arbitrary commands via unspe
- 9.8 Critical severity
DiskStation Manager (DSM): Buffer Copy without Checking Size of Input
Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in Authentication functionality in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via unspecified vectors.
- 7.5 High severity
DiskStation Manager (DSM): Exposure of Sensitive Information to an Unauthorized Actor
Exposure of sensitive information to an unauthorized actor vulnerability in Web Server in Synology DiskStation Manager (DSM) before 7.0.1-42218-2 allows remote attackers to obtain sensitive information via unspecified vectors.
- 7.8 High severity
Sudo Heap-Based Buffer Overflow Exploited
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.
- 10.0 Critical severity
Microsoft Netlogon Privilege Escalation Exploited
An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC). An attacker who successfully exploited the vulnerability could run