{"id":"CVE-2026-15201","kind":"vulnerability","aliases":["CVE-2026-15201"],"related":[],"title":"Synology DSM: Support Form certificate check flaw enables man-in-the-middle file access","description":"An improper certificate validation vulnerability in the Support Form in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows man-in-the-middle attackers to read arbitrary files and write specific files during support form submission.","summary":"The Support Form in Synology DiskStation Manager does not properly validate certificates when submitting a support request. A network attacker positioned between the NAS and Synology can read arbitrary files and write specific files during that submission.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dsm","infrastructure","nas","self-hosted","synology"],"not_affected_if":["no-support-form-use","patched-dsm"],"how_to_check":"- Check the DSM version under Control Panel > Info Center; compare it with the fixed versions below.","fix":"- DSM `7.3.2-86009-5` for the 7.3 branch\n- DSM `7.4.1-90080-1` for the 7.4 branch","status":"open","published_at":"2026-11-12T04:17:18+00:00","first_seen_at":"2026-11-12T04:47:08+00:00","triaged_at":"2026-11-12T04:47:52+00:00","updated_at":"2026-11-12T04:47:52+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-12T04:47:52Z","model":"claude-haiku-5-5","output":{"fix":"- DSM `7.3.2-86009-5` for the 7.3 branch\n- DSM `7.4.1-90080-1` for the 7.4 branch","reach":"network","title":"Synology DSM: Support Form certificate check flaw enables man-in-the-middle file access","impact":"high","summary":"The Support Form in Synology DiskStation Manager does not properly validate certificates when submitting a support request. A network attacker positioned between the NAS and Synology can read arbitrary files and write specific files during that submission.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["synology","dsm","nas","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"attacker reads arbitrary files and writes specific files on the NAS","analyst_note":"","how_to_check":"- Check the DSM version under Control Panel > Info Center; compare it with the fixed versions below.\n- unknown for other checks; the sources do not say.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["patched-dsm","no-support-form-use"],"who_is_affected":"Only DiskStation Manager installations that use the Support Form are exposed, and the attacker must sit on the network path during submission. Systems on DSM versions before the fixed builds should be reviewed; the sources do not say whether the default configuration is affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000713,"input_tokens":4548,"output_tokens":517,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-1':87C '-15201':18A,21A '-2026':17A,20A '-5':83C '-86009':82C '-90080':86C '7.3.2':81C '7.4.1':85C 'access':15A 'allow':88C 'arbitrari':57B,97C 'attack':48B,94C 'certif':5A,40B,68C 'check':6A 'cve':16A,19A 'diskstat':34B,77C 'dsm':2A,22B,79C 'enabl':8A 'file':14A,58B,62B,98C,102C 'flaw':7A 'form':4A,31B,74C,105C 'host':27B 'improp':67C 'infrastructur':23B 'man':10A,90C 'man-in-the-middl':9A,89C 'manag':35B,78C 'middl':13A,93C 'nas':24B,52B 'network':47B 'posit':49B 'proper':38B 'read':56B,96C 'request':45B 'self':26B 'self-host':25B 'specif':61B,101C 'submiss':65B,106C 'submit':42B 'support':3A,30B,44B,73C,104C 'synolog':1A,28B,33B,54B,76C 'valid':39B,69C 'vulner':70C 'write':60B,100C","nicknames":[],"mitigations":[],"who_affected":"Only DiskStation Manager installations that use the Support Form are exposed, and the attacker must sit on the network path during submission. Systems on DSM versions before the fixed builds should be reviewed; the sources do not say whether the default configuration is affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dsm","infrastructure","medium","nas","selfhosted","synology"],"campaign_type":null,"search_a":"'-15201':18A,21A '-2026':17A,20A 'access':15A 'certif':5A 'check':6A 'cve':16A,19A 'dsm':2A 'enabl':8A 'file':14A 'flaw':7A 'form':4A 'man':10A 'man-in-the-middl':9A 'middl':13A 'support':3A 'synolog':1A","search_b":"'arbitrari':57B 'attack':48B 'certif':40B 'diskstat':34B 'dsm':22B 'file':58B,62B 'form':31B 'host':27B 'infrastructur':23B 'manag':35B 'nas':24B,52B 'network':47B 'posit':49B 'proper':38B 'read':56B 'request':45B 'self':26B 'self-host':25B 'specif':61B 'submiss':65B 'submit':42B 'support':30B,44B 'synolog':28B,33B,54B 'valid':39B 'write':60B","search_c":"'-1':87C '-5':83C '-86009':82C '-90080':86C '7.3.2':81C '7.4.1':85C 'allow':88C 'arbitrari':97C 'attack':94C 'certif':68C 'diskstat':77C 'dsm':79C 'file':98C,102C 'form':74C,105C 'improp':67C 'man':90C 'man-in-the-middl':89C 'manag':78C 'middl':93C 'read':96C 'specif':101C 'submiss':106C 'support':73C,104C 'synolog':76C 'valid':69C 'vulner':70C 'write':100C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T04:17:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N","cvss_by":"security@synology.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-15201","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15201","severity":null,"published_at":"2026-11-12T04:17:18+00:00","modified_at":"2026-11-12T04:17:18+00:00","first_seen_at":"2026-11-12T04:47:08+00:00","fetched_at":"2026-11-12T04:47:08+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}