DiskStation Manager (< 7.2.1-69057-13, < 7.2.2-72806-10, < 7.3.2-86009-5, < 7.4.1-90080-1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/diskstation-manager--7.2.1-69057-13--7.2.2-72806-10--7.3.2-86009-5--7.4.1-90080-1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 12 Nov 2026 09:30:13 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgSynology DiskStation Manager: Auth API SQL Injection (CVE-2026-76954)https://feed.craftedsignal.io/briefs/2026-11-synology-dsm-sqli-cve-2026-76954/Thu, 12 Nov 2026 09:30:13 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-synology-dsm-sqli-cve-2026-76954/An improper neutralization of special elements used in an SQL command vulnerability in the Auth API of Synology DiskStation Manager (DSM) allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks.Synology DiskStation Manager (DSM) contains an improper neutralization of special elements used in an SQL command vulnerability (CVE-2026-76954) within the Auth API. This vulnerability allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks.

Impact

Successful exploitation can result in the ability to read or write arbitrary files and conduct denial-of-service attacks.

Recommendation

Apply updates provided by the vendor to remediate the vulnerability.

]]>criticaladvisory