Improper Neutralization Vulnerability in Synology DiskStation Manager's SNMP API
CVE-2026-86343

6.8MEDIUM

Key Information:

Vendor

Synology
Status
Diskstation Manager (dsm)
Vendor
CVE Published:
12 November 2026

What is CVE-2026-86343?

A vulnerability within the SNMP API of Synology DiskStation Manager (DSM) enables remote authenticated users with administrative privileges to exploit improper neutralization of CRLF sequences. This could allow these users to read or write arbitrary files on the system and potentially conduct denial-of-service attacks, compromising the overall security and functionality of the device.

Affected Version(s)

DiskStation Manager (DSM) 7.4.1

DiskStation Manager (DSM) 7.4.1 < 7.4.1-90080-1

DiskStation Manager (DSM) 7.3.2 < 7.3.2-86009-5

References

https://www.synology.com/en-global/security/advisory/Syno...

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jincheng Wang (@winmt) from Nanjing University of Posts and Telecommunications
.