Synology DSM Vulnerabilities: MITM & RCE via CVE-2021-26560-26565

Vulnerability Overview A vulnerability exists in older versions of DSM and Relay on Synology devices, allowing attackers to intercept sensitive information and execute commands via a Man-in-the-Middle (MITM) attack. This vulnerability is associated with multiple CVE identifiers, including CVE-2021-26560, CVE-2021-26561, CVE-2021-26562, CVE-2021-26564, and CVE-2021-26565. Impact Scope Affected Versions: DSM 6.2.3-25426 Update 3 and earlier versions. Affected Devices: All Synology devices running the aforementioned DSM versions. Specific Impacts: - Attackers can intercept and redirect traffic between Synology servers. - Attackers can execute commands. - Attackers can obtain authentication keys, token values, NAS serial numbers, model identifiers, MAC addresses, QuickConnect aliases, HTTP session cookies, internal IPv4 and IPv6 addresses, internal gateways and network masks, DNS hostnames, enabled services, internal or external mapped service ports, DSM management ports, device time zones, and other system metadata. Remediation Recommended Action: Immediately upgrade to DSM 6.2.3-25426 Update 3 or later. Devices Unable to Upgrade: If a device cannot run this version or later, consider replacing, decommissioning, or isolating it from Synology Cloud services. Specific Model Support: The following models support installation of DSM 6.2.3-25426 Update 3 or later: - DS212j - DS212j - DS214+ - DS214play - DS214se - DS215+ - DS216+ - DS414slim - DS416j - DS713+ - DS115j - RS815+ Additional Information Historical Background: This vulnerability was first reported to Synology on July 7, 2020, and an initial fix was deployed on July 22, 2020. Assessment: While Synology classified this issue as a hardcoded problem, researchers consider it a genuine security vulnerability that could lead to customer data leakage. Conclusion This vulnerability allows attackers to intercept and redirect traffic between Synology servers via Man-in-the-Middle attacks and execute commands. Users are advised to immediately upgrade to DSM 6.2.3-25426 Update 3 or later to remediate this issue.

Goal Reached Thanks to every supporter — we hit 100%!

Synology DSM Vulnerabilities: MITM & RCE via CVE-2021-26560-26565