Synology DiskStation Manager (DSM)

Name: Synology DiskStation Manager (DSM)
Brand: Synology

productEU

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

by severity

11critical20high14medium2low

updated 2026-10-28

vulnerabilities (53)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2017-15889US	high8.8	73.7% (99th)	Exploit	no fix	2017-12-04	≤ before 5.2-5967-5
CVE-2024-50629US	—	31.9% (98th)	Exploit	6.2.4-25556-8	2025-03-19	5 versions
CVE-2024-10441US	—	1.25% (69th)	Exploit	7.1.1-42962-7	2025-03-19	6 versions
CVE-2022-22687US	critical9.8	2.43% (84th)	—	6.2.3-25426-3	2022-03-25	unspecified → 6.2.3-25426-3
CVE-2018-13284US	high8.8	2.31% (83rd)	—	6.2-23739-1	2019-04-01	unspecified → 6.2-23739-1
CVE-2021-27649US	critical9.8	2.01% (81st)	—	6.2.3-25426-3	2021-06-23	unspecified → 6.2.3-25426-3
CVE-2017-12075US	high7.2	1.94% (80th)	—	6.2-23739	2018-06-08	unspecified → 6.2-23739
CVE-2022-27625US	critical9.8	1.79% (78th)	—	7.1.1-42962-2	2022-10-20	unspecified → 7.1.1-42962-2
CVE-2022-27624US	critical9.8	1.79% (78th)	—	7.1.1-42962-2	2022-10-20	unspecified → 7.1.1-42962-2
CVE-2022-27616US	high7.2	1.69% (77th)	—	7.0.1-42218-3	2022-08-03	unspecified → 7.0.1-42218-3
CVE-2022-22684US	high8.8	1.60% (76th)	—	6.2.4-25553	2022-07-28	unspecified → 6.2.4-25553
CVE-2022-22688US	high8.8	1.60% (76th)	—	6.2.4-25556-2	2022-03-25	unspecified → 6.2.4-25556-2
CVE-2022-27610US	high8.1	1.56% (75th)	—	6.2.3-25423	2022-07-27	unspecified → 6.2.3-25423
CVE-2018-8919US	critical9.8	1.44% (73rd)	—	6.1.6-15266	2018-12-24	unspecified → 6.1.6-15266
CVE-2021-29087US	high7.5	1.40% (72nd)	—	6.2.3-25426-3	2021-06-23	unspecified → 6.2.3-25426-3
CVE-2021-29085US	high7.5	1.33% (71st)	—	6.2.3-25426-3	2021-06-23	unspecified → 6.2.3-25426-3
CVE-2021-29084US	high7.5	1.33% (71st)	—	6.2.3-25426-3	2021-06-23	unspecified → 6.2.3-25426-3
CVE-2018-13286US	medium6.5OT elevated	1.31% (70th)	—	6.2-23739-1	2019-04-01	unspecified → 6.2-23739-1
CVE-2022-27626US	high8.1	1.26% (70th)	—	7.1.1-42962-2	2022-10-20	unspecified → 7.1.1-42962-2
CVE-2022-3576US	high7.5	1.20% (68th)	—	7.1.1-42962-2	2022-10-20	unspecified → 7.1.1-42962-2
CVE-2018-13291US	medium4.3	1.19% (68th)	—	6.2.1-23824	2019-04-01	unspecified → 6.2.1-23824
CVE-2021-29086US	high7.5	1.18% (68th)	—	6.2.3-25426-3	2021-06-23	unspecified → 6.2.3-25426-3
CVE-2018-13281US	medium4.3	1.18% (68th)	—	6.2-23739-2	2018-10-31	unspecified → 6.2-23739-2
CVE-2022-22679US	medium4.9	1.16% (67th)	—	7.0.1-42218-2	2022-02-07	unspecified → 7.0.1-42218-2
CVE-2022-22680US	high7.5	1.14% (67th)	—	7.0.1-42218-2	2022-02-07	unspecified → 7.0.1-42218-2
CVE-2018-8920US	high7.2	1.03% (64th)	—	6.1.6-15266	2018-12-24	unspecified → 6.1.6-15266
CVE-2022-27623US	critical9.1OT elevated	1.02% (63rd)	—	7.1-42661	2022-10-25	unspecified → 7.1-42661
CVE-2018-8916US	high8.8	0.98% (62nd)	—	6.2-23739	2018-06-08	unspecified → 6.2-23739
CVE-2023-0142US	high8.1	0.97% (62nd)	—	6.2.4-25556-8	2023-06-13	4 versions
CVE-2021-43927US	critical9.8	0.88% (59th)	—	7.0.1-42218-2	2022-02-07	unspecified → 7.0.1-42218-2
CVE-2021-43926US	critical9.8	0.88% (59th)	—	7.0.1-42218-2	2022-02-07	unspecified → 7.0.1-42218-2
CVE-2021-43925US	critical9.8	0.88% (59th)	—	7.0.1-42218-2	2022-02-07	unspecified → 7.0.1-42218-2
CVE-2023-2729US	high7.5OT elevated	0.88% (59th)	—	7.1.*	2023-06-13	4 versions
CVE-2020-27652US	high8.3OT elevated	0.83% (57th)	—	6.2.3-25426-2	2020-10-29	unspecified → 6.2.3-25426-2
CVE-2022-27622US	medium4.3	0.82% (57th)	—	7.1-42661	2022-10-25	unspecified → 7.1-42661
CVE-2017-16774US	medium5.4	0.81% (57th)	—	6.1.4-15217-3	2019-04-01	unspecified → 6.1.4-15217-3
CVE-2018-13293US	medium5.4	0.80% (57th)	—	6.2.1-23824	2019-04-01	unspecified → 6.2.1-23824
CVE-2018-8917US	medium5.4	0.80% (57th)	—	6.1.6-15266	2018-12-24	unspecified → 6.1.6-15266
CVE-2017-16766US	medium6.5	0.74% (55th)	—	no fix	2017-12-22	2 versions
CVE-2020-27648US	critical9.0	0.72% (54th)	—	6.2.3-25426-2	2020-10-29	unspecified → 6.2.3-25426-2
CVE-2018-13280US	medium5.9OT elevated	0.63% (50th)	—	6.2-23739	2018-07-30	unspecified → 6.2-23739
CVE-2021-43929US	medium5.4	0.60% (48th)	—	7.0.1-42218-2	2022-02-07	unspecified → 7.0.1-42218-2
CVE-2020-27650US	low3.7OT elevated	0.56% (46th)	—	6.2.3-25426-2	2020-10-29	unspecified → 6.2.3-25426-2
CVE-2020-27656US	low3.7OT elevated	0.55% (46th)	—	6.2.3-25426-2	2020-10-29	unspecified → 6.2.3-25426-2
CVE-2025-13392US	critical9.8	0.53% (45th)	—	7.2.1	2026-05-27	3 versions
CVE-2025-1021US	—OT elevated	0.53% (45th)	—	7.1.1-42962-8	2025-04-23	4 versions
CVE-2021-26563US	medium6.7OT elevated	0.51% (44th)	—	6.2.4-25553	2021-02-26	unspecified → 6.2.4-25553
CVE-2024-45539US	—	0.48% (41st)	—	7.2.2-72806	2025-12-04	2 versions
CVE-2024-5401US	high8.8	0.38% (32nd)	—	7.2.1-69057-2	2025-12-04	2 versions
CVE-2024-10445US	medium5.3	0.38% (32nd)	—	7.2.2-72806-1	2025-03-19	5 versions

showing 50 of 53

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-200Exposure of Sensitive Information to an Unauthorized Actor5 CVEs
CWE-74Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')4 CVEs
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')4 CVEs
CWE-116Improper Encoding or Escaping of Output3 CVEs
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')3 CVEs
CWE-295Improper Certificate Validation3 CVEs
CWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')3 CVEs
CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')3 CVEs

sources (2)

Which sources assert this record, and when.

EUEU Vulnerability Database (ENISA)53 CVEs
NLNCSC-NL (CSAF)1 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan