Improper Certificate Validation in Synology DiskStation Manager Support Form
CVE-2026-15201

5.9MEDIUM

Key Information:

Vendor

Synology
Status
Diskstation Manager (dsm)
Vendor
CVE Published:
12 November 2026

What is CVE-2026-15201?

There exists a vulnerability in the Support Form of Synology DiskStation Manager that allows attackers to exploit improper certificate validation. This security flaw enables man-in-the-middle attacks, granting unauthorized access that can lead to arbitrary file reading and specific file writing during the support form submission process. Users are strongly encouraged to upgrade to unaffected versions of the software to mitigate potential risks associated with this vulnerability.

Affected Version(s)

DiskStation Manager (DSM) 7.4.1

DiskStation Manager (DSM) 7.4.1 < 7.4.1-90080-1

DiskStation Manager (DSM) 7.3.2 < 7.3.2-86009-5

References

https://www.synology.com/en-global/security/advisory/Syno...

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

JUNYI LIU (@mosskappa)
.