DiskStation Manager (DSM < 7.2.1-69057-13, < 7.2.2-72806-10, < 7.3.2-86009-5, < 7.4.1-90080-1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/diskstation-manager-dsm--7.2.1-69057-13--7.2.2-72806-10--7.3.2-86009-5--7.4.1-90080-1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 12 Nov 2026 06:13:56 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgSynology DiskStation Manager: Authentication bypass in rsync (CVE-2026-85101)https://feed.craftedsignal.io/briefs/2026-11-synology-dsm-auth-bypass-cve-2026-85101/Thu, 12 Nov 2026 06:13:56 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-synology-dsm-auth-bypass-cve-2026-85101/Synology DiskStation Manager (DSM) contains an authentication bypass vulnerability in its rsync implementation that allows remote attackers to read or write arbitrary files and trigger a denial-of-service.Synology DiskStation Manager (DSM) is vulnerable to an authentication bypass via an alternate path or channel within its rsync implementation (CVE-2026-85101). This vulnerability allows unauthenticated remote attackers to perform unauthorized file operations, including reading and writing arbitrary files, or disrupting system availability through denial-of-service. The vulnerability is rated with a CVSS v3.1 base score of 8.6.

Impact

Successful exploitation allows remote attackers to manipulate files on the affected device, potentially leading to unauthorized data access, system modification, or service disruption.

Recommendation

Immediately apply the relevant security patches for Synology DiskStation Manager (DSM) to remediate the vulnerability. Users must verify their DSM version and update to at least 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, or 7.4.1-90080-1, depending on their environment.

]]>highadvisory