CVE-2026-76954 An improper neutralization of special elements used in an SQL command vulnerability in the Auth API in Synology DiskStation Manager (DSM) before 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, and 7.4....
CriticalCVSS 9.8
- Published
- Updated
- Exploit status
- No public exploit known
Description
An improper neutralization of special elements used in an SQL command vulnerability in the Auth API in Synology DiskStation Manager (DSM) before 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, and 7.4.1-90080-1 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Synology DiskStation Manager (DSM) | >= 7.4.1, < 7.4.1-90080-1 | 7.4.1-90080-1 |
| Synology DiskStation Manager (DSM) | >= 7.3.2, < 7.3.2-86009-5 | 7.3.2-86009-5 |
| Synology DiskStation Manager (DSM) | >= 7.2.2, < 7.2.2-72806-10 | 7.2.2-72806-10 |
| Synology DiskStation Manager (DSM) | >= 7.2.1, < 7.2.1-69057-13 | 7.2.1-69057-13 |
| Synology DiskStation Manager (DSM) | < 7.2.1 | 7.2.1 |