{"id":"CVE-2026-75785","kind":"vulnerability","aliases":["CVE-2026-75785"],"related":[],"title":"Synology DSM: VPN API command injection lets admins read and write files","description":"An improper neutralization of special elements used in an OS command vulnerability in the VPN API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users with administrator privileges to read or write arbitrary files and conduct denial-of-service attacks.","summary":"An OS command injection flaw in the VPN API of Synology DiskStation Manager lets an authenticated administrator read or write arbitrary files and cause denial of service. The sources rate it high (CVSS 7.2) and give fixed versions 7.3.2-86009-5 and 7.4.1-90080-1 for the affected DSM branches.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dsm","infrastructure","nas","synology","vpn"],"not_affected_if":["no-admin-exposure","patched-dsm"],"how_to_check":"- Check the installed DSM version in the DSM web interface under Control Panel > Info Center.\n- Compare it with the fixed versions `7.3.2-86009-5` and `7.4.1-90080-1`; older builds on those branches are affected.","fix":"- Synology DSM: upgrade to `7.3.2-86009-5` or `7.4.1-90080-1` (the fixed version on your branch).","status":"open","published_at":"2026-11-12T04:17:20+00:00","first_seen_at":"2026-11-12T04:47:09+00:00","triaged_at":"2026-11-12T04:47:48+00:00","updated_at":"2026-11-12T04:47:48+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-12T04:47:48Z","model":"claude-haiku-5-5","output":{"fix":"- Synology DSM: upgrade to `7.3.2-86009-5` or `7.4.1-90080-1` (the fixed version on your branch).","reach":"network","title":"Synology DSM: VPN API command injection lets admins read and write files","impact":"high","summary":"An OS command injection flaw in the VPN API of Synology DiskStation Manager lets an authenticated administrator read or write arbitrary files and cause denial of service. The sources rate it high (CVSS 7.2) and give fixed versions 7.3.2-86009-5 and 7.4.1-90080-1 for the affected DSM branches.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["synology","dsm","nas","vpn"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Admin attacker reads or writes arbitrary files and disrupts service","analyst_note":"","how_to_check":"- Check the installed DSM version in the DSM web interface under Control Panel > Info Center.\n- Compare it with the fixed versions `7.3.2-86009-5` and `7.4.1-90080-1`; older builds on those branches are affected.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["patched-dsm","no-admin-exposure"],"who_is_affected":"Only Synology DSM installs whose VPN API is reachable by an administrator account are affected, which requires DSM before the fixed builds. Attackers need valid administrator credentials, so systems with few admin accounts and no exposed admin interface carry less risk. unknown whether the VPN feature must be enabled for exposure.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000768,"input_tokens":4559,"output_tokens":624,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-1':68B,102C '-2026':14A,17A '-5':64B,98C '-75785':15A,18A '-86009':63B,97C '-90080':67B,101C '7.2':57B '7.3.2':62B,96C '7.4.1':66B,100C 'admin':8A 'administr':40B,108C 'affect':71B 'allow':103C 'api':4A,32B,89C 'arbitrari':44B,114C 'attack':122C 'authent':39B,105C 'branch':73B 'caus':47B 'command':5A,26B,84C 'conduct':117C 'cve':13A,16A 'cvss':56B 'denial':48B,119C 'denial-of-servic':118C 'diskstat':35B,92C 'dsm':2A,19B,72B,94C 'element':79C 'file':12A,45B,115C 'fix':60B 'flaw':28B 'give':59B 'high':55B 'improp':75C 'infrastructur':20B 'inject':6A,27B 'let':7A,37B 'manag':36B,93C 'nas':21B 'neutral':76C 'os':25B,83C 'privileg':109C 'rate':53B 'read':9A,41B,111C 'remot':104C 'servic':50B,121C 'sourc':52B 'special':78C 'synolog':1A,22B,34B,91C 'use':80C 'user':106C 'version':61B 'vpn':3A,23B,31B,88C 'vulner':85C 'write':11A,43B,113C","nicknames":[],"mitigations":[],"who_affected":"Only Synology DSM installs whose VPN API is reachable by an administrator account are affected, which requires DSM before the fixed builds. Attackers need valid administrator credentials, so systems with few admin accounts and no exposed admin interface carry less risk. unknown whether the VPN feature must be enabled for exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dsm","high","infrastructure","nas","synology","vpn"],"campaign_type":null,"search_a":"'-2026':14A,17A '-75785':15A,18A 'admin':8A 'api':4A 'command':5A 'cve':13A,16A 'dsm':2A 'file':12A 'inject':6A 'let':7A 'read':9A 'synolog':1A 'vpn':3A 'write':11A","search_b":"'-1':68B '-5':64B '-86009':63B '-90080':67B '7.2':57B '7.3.2':62B '7.4.1':66B 'administr':40B 'affect':71B 'api':32B 'arbitrari':44B 'authent':39B 'branch':73B 'caus':47B 'command':26B 'cvss':56B 'denial':48B 'diskstat':35B 'dsm':19B,72B 'file':45B 'fix':60B 'flaw':28B 'give':59B 'high':55B 'infrastructur':20B 'inject':27B 'let':37B 'manag':36B 'nas':21B 'os':25B 'rate':53B 'read':41B 'servic':50B 'sourc':52B 'synolog':22B,34B 'version':61B 'vpn':23B,31B 'write':43B","search_c":"'-1':102C '-5':98C '-86009':97C '-90080':101C '7.3.2':96C '7.4.1':100C 'administr':108C 'allow':103C 'api':89C 'arbitrari':114C 'attack':122C 'authent':105C 'command':84C 'conduct':117C 'denial':119C 'denial-of-servic':118C 'diskstat':92C 'dsm':94C 'element':79C 'file':115C 'improp':75C 'manag':93C 'neutral':76C 'os':83C 'privileg':109C 'read':111C 'remot':104C 'servic':121C 'special':78C 'synolog':91C 'use':80C 'user':106C 'vpn':88C 'vulner':85C 'write':113C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T04:17:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@synology.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-75785","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75785","severity":null,"published_at":"2026-11-12T04:17:20+00:00","modified_at":"2026-11-12T04:17:20+00:00","first_seen_at":"2026-11-12T04:47:09+00:00","fetched_at":"2026-11-12T04:47:09+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}