DiskStation Manager (< 7.4.1-90080-1, < 7.3.2-86009-5) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/diskstation-manager--7.4.1-90080-1--7.3.2-86009-5/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 12 Nov 2026 09:31:11 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgSynology DiskStation Manager: SQL Injection in User API (CVE-2026-81584)https://feed.craftedsignal.io/briefs/2026-11-synology-dsm-sqli-cve-2026-81584/Thu, 12 Nov 2026 09:31:11 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-synology-dsm-sqli-cve-2026-81584/An SQL injection vulnerability in the Synology DiskStation Manager (DSM) User API, tracked as CVE-2026-81584, allows remote attackers who have compromised an integrated LDAP or Active Directory server to perform arbitrary file operations or trigger a denial-of-service.CVE-2026-81584 describes an improper neutralization of special elements used in an SQL command within the User API of Synology DiskStation Manager (DSM). The vulnerability is exploitable by an attacker who has already gained control over an integrated LDAP or Active Directory server used by the DSM instance. Successful exploitation allows for arbitrary file read and write operations, as well as denial-of-service attacks against the Synology appliance.

Impact

Exploitation can lead to unauthorized data access, system modification, or denial-of-service. The CVSS v3.1 base score for this vulnerability is 8.1.

Recommendation

  • Upgrade to Synology DSM version 7.3.2-86009-5 or 7.4.1-90080-1 or later to remediate this vulnerability.
  • Ensure that integrated LDAP and Active Directory infrastructure is hardened and monitored, as compromise of these services is a prerequisite for exploiting this vulnerability.
  • Monitor DSM access logs and system resource utilization for signs of unauthorized API access or unexpected service interruptions.
]]>highadvisory