Synology Patches 27 Flaws in DiskStation Manager Including Critical Pre-Auth SQL Injection

Entenda a falha

A vulnerabilidade

Synology DiskStation Manager (DSM) has 27 flaws across two reports; the story lists 11 CVEs. The worst is CVE-2026-76954 (CVSS 9.8), an SQL injection (CWE-89) in the Auth API. A remote, unauthenticated attacker can read or write arbitrary files and cause denial of service. Next is CVE-2026-85101 (CVSS 8.6), an unauthenticated login bypass (CWE-288) in rsync that allows reading specific files, writing arbitrary files and limited DoS. SA-26:18 adds authenticated flaws: CVE-2026-13672 (SSOAuth), CVE-2026-18792 (Sharing API) and CVE-2026-74857 (Auth API), all 8.8. It also adds CVE-2026-18596 (OTP bypass), CVE-2026-19048 (symlink in thumb) and CVE-2026-81584 (SQL injection in the User API via a rogue LDAP server), all 8.1. Lower scores: CVE-2026-18633 (nfsd pointer crash), CVE-2026-75785 (VPN API command injection) and CVE-2026-15198 (missing login checks in WebDAV). SA-26:19 covers DSM 7.4, 7.3, 7.2.2 and 7.2.1; SA-26:18 covers 7.4 and 7.3. Fixed in 7.4.1-90080-1, 7.3.2-86009-5, 7.2.2-72806-10 and 7.2.1-69057-13. No workarounds exist.

Como funciona

For the most severe flaw, a network request reaches the DSM Auth API without any login. The articles do not detail the internal steps, but an SQL injection means data from the request ends up inside a database query and is interpreted as part of the query instead of plain data. That lets the attacker go beyond what the API should allow, and the vendor says the result is arbitrary file read or write and denial of service. In the rsync flaw, the authentication step that should gate access can be bypassed, so a remote client gets file access without valid credentials.

Por que é vulnerável

CVE-2026-76954 is classified as CWE-89, meaning the Auth API does not properly neutralize input before using it in an SQL query. CVE-2026-85101 is classified as CWE-288, an authentication bypass in rsync where an alternate path skips the login check. The articles do not say why these went unnoticed or what exactly the patches change in the code; the fix is delivered through the updated DSM builds.

Onde está

The advisories name the Auth API (CVE-2026-76954) and rsync (CVE-2026-85101) in DSM; the articles name no files, functions or commits.

Como foi descoberta

The articles do not say who found the flaws or how. Synology disclosed them in advisory Synology-SA-26:19 (two unauthenticated flaws) and bulletin Synology-SA-26:18 (25 flaws). Viettel Cyber Security researchers are cited as listing CVE-2026-76954 as a pre-auth, zero-click remote code execution flaw, a characterization that goes beyond the vendor's description of file read/write and DoS. No active exploitation is confirmed.

Explicação gerada por IA a partir da matéria e dos artigos, em 10/11/2026 15:15.