PT-2021-17038 · Synology · Synology Diskstation Manager

Claudio Bozzato + 1 · Published 2021-02-26 · Updated 2025-01-14 · CVE-2021-26560

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Synology DiskStation Manager (DSM) versions prior to 6.2.3-25426-3

Description The issue concerns the cleartext transmission of sensitive information in the synoagentregisterd component, allowing man-in-the-middle attackers to spoof servers via an HTTP session. This can be exploited by attackers to intercept and manipulate sensitive data.

Recommendations For versions prior to 6.2.3-25426-3, update to version 6.2.3-25426-3 or later to resolve the issue. As a temporary workaround, consider restricting access to the synoagentregisterd component to minimize the risk of exploitation. Avoid using HTTP sessions for sensitive information transmission until the issue is resolved.

Exploit

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2021-26560

Affected Products

Synology Diskstation Manager

References · 5

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2020-1159 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-26560 · Security Note
• https://osv.dev/vulnerability/CVE-2021-26560 · Vendor Advisory
• https://synology.com/security/advisory/Synology_SA_20_26 · Vendor Advisory
• https://t.me/cibsecurity/24261 · Telegram Post