PT-2025-17598 · Synology · Synology Diskstation Manager

Published

2025-02-26

·

Updated

2025-11-17

·

CVE-2025-1021

CVSS v2.0

7.8

High

VectorAV:N/AC:L/Au:N/C:C/I:N/A:N
Name of the Vulnerable Software and Affected Versions Synology DiskStation Manager (DSM) versions prior to 7.1.1-42962-8 Synology DiskStation Manager (DSM) versions prior to 7.2.1-69057-7 Synology DiskStation Manager (DSM) versions prior to 7.2.2-72806-3
Description A missing authorization vulnerability in synocopy in Synology DiskStation Manager (DSM) allows remote attackers to read arbitrary files via unspecified vectors. This issue enables unauthorized access to files, posing a significant risk to data security.
Recommendations For versions prior to 7.1.1-42962-8, update to version 7.1.1-42962-8 or later. For versions prior to 7.2.1-69057-7, update to version 7.2.1-69057-7 or later. For versions prior to 7.2.2-72806-3, update to version 7.2.2-72806-3 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2026-00057
CVE-2025-1021

Affected Products

Synology Diskstation Manager