CVE-2026-13635
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
An improper encoding or escaping of output vulnerability in the Auth API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to obtain non-sensitive information.
Risk Assessment
A remote attacker can obtain non-sensitive information about the system, aiding reconnaissance for further attacks. The leak may expose configuration or metadata that facilitates escalation.
Recommendation
Update Synology DSM to version 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, 7.4-90075 or later. Restrict access to the DSM management interface to trusted networks.
Other vulnerabilities in Synology DiskStation Manager (DSM)
See all- CVE-2017-15889High
A command injection vulnerability in smart.cgi in Synology DiskStation Manager (DSM) before version 5.2-5967-5 allows remote authenticated users to execute arbitrary commands via the disk field.
- CVE-2026-13684Critical
An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks.
- CVE-2026-13639Critical
An insufficient entropy vulnerability in login logic in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks.
- CVE-2026-13623Medium
An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in the Theme API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users with administrator privileges to read or write limited files.
- CVE-2024-5401Medium
An improper control of dynamically-managed code resources vulnerability in the WebAPI component in Synology DiskStation Manager (DSM) before 7.1.1-42962-8, 7.2.1-69057-2, and 7.2.2-72806 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote authenticated users to obtain privileges without consent via unspecified vectors.
Original NVD description (English source)
An improper encoding or escaping of output vulnerability in Auth API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to obtain non-sensitive information.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS