Info Multiple vulnerabilities in Synology DiskStation Manager

[Telos]

April 20, 2021
Cisco Talos recently discovered multiple vulnerabilities in Synology DiskStation Manager.

Read on...

 

[fredbert]

Hmm, run on DSM 6.2.3 25426-2.

The DSM 6.2.3 25426-3 and 6.2.4 release notes reference fixes for acknowledged security vulnerabilities, including ones discovered by the same person. Haven't had time to cross-reference the CVE.

 

[Telos]

Good catch. I thought that a new post from Cisco would be accurate. But following your post, I tracked down the cited TALOS entries, and it appears that Synology stated that these vulnerabilities were "fixed" in 6.2.3-25426 Update 3.

Source