{"id":"CVE-2026-86343","kind":"vulnerability","aliases":["CVE-2026-86343"],"related":[],"title":"Synology DSM: SNMP API CRLF flaw lets admins read or write files","description":"An improper neutralization of CRLF sequences vulnerability in the SNMP API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users with administrator privileges to read or write arbitrary files and conduct denial-of-service attacks.","summary":"DiskStation Manager's SNMP API does not neutralize CRLF sequences in input, so an authenticated administrator can inject line breaks and misuse the API. An attacker with admin rights can read or write arbitrary files and cause denial of service.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dsm","infrastructure","nas","snmp","synology"],"not_affected_if":["no-admin-exposure","patched-dsm"],"how_to_check":"- Check the installed DSM version in Control Panel > Info Center and compare it with the fixed versions below.\n- Confirm whether SNMP is enabled in Control Panel > Terminal & SNMP.","fix":"- DSM before `7.3.2-86009-5` is affected; move to `7.3.2-86009-5` or later on the 7.3 branch.\n- DSM before `7.4.1-90080-1` is affected; move to `7.4.1-90080-1` or later on the 7.4 branch.","status":"open","published_at":"2026-11-12T04:17:21+00:00","first_seen_at":"2026-11-12T04:47:10+00:00","triaged_at":"2026-11-12T04:47:48+00:00","updated_at":"2026-11-12T04:47:48+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-12T04:47:48Z","model":"claude-haiku-5-5","output":{"fix":"- DSM before `7.3.2-86009-5` is affected; move to `7.3.2-86009-5` or later on the 7.3 branch.\n- DSM before `7.4.1-90080-1` is affected; move to `7.4.1-90080-1` or later on the 7.4 branch.","reach":"network","title":"Synology DSM: SNMP API CRLF flaw lets admins read or write files","impact":"high","summary":"DiskStation Manager's SNMP API does not neutralize CRLF sequences in input, so an authenticated administrator can inject line breaks and misuse the API. An attacker with admin rights can read or write arbitrary files and cause denial of service.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["synology","dsm","nas","snmp"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Admin attacker reads or writes arbitrary files, disrupts the NAS","analyst_note":"","how_to_check":"- Check the installed DSM version in Control Panel > Info Center and compare it with the fixed versions below.\n- Confirm whether SNMP is enabled in Control Panel > Terminal & SNMP.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["patched-dsm","no-admin-exposure"],"who_is_affected":"Systems running Synology DiskStation Manager versions before the fixed builds, where SNMP is part of the setup. The attacker must already hold administrator credentials on the NAS, so exposure is limited to environments where admin access is shared or compromised. Systems on patched DSM builds or with no admin accounts exposed can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000766,"input_tokens":4571,"output_tokens":617,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-1':87C '-2026':14A,17A '-5':83C '-86009':82C '-86343':15A,18A '-90080':86C '7.3.2':81C '7.4.1':85C 'admin':8A,51B 'administr':39B,93C 'allow':88C 'api':4A,28B,47B,74C 'arbitrari':57B,99C 'attack':49B,107C 'authent':38B,90C 'break':43B 'caus':60B 'conduct':102C 'crlf':5A,32B,68C 'cve':13A,16A 'denial':61B,104C 'denial-of-servic':103C 'diskstat':24B,77C 'dsm':2A,19B,79C 'file':12A,58B,100C 'flaw':6A 'improp':65C 'infrastructur':20B 'inject':41B 'input':35B 'let':7A 'line':42B 'manag':25B,78C 'misus':45B 'nas':21B 'neutral':31B,66C 'privileg':94C 'read':9A,54B,96C 'remot':89C 'right':52B 'sequenc':33B,69C 'servic':63B,106C 'snmp':3A,22B,27B,73C 'synolog':1A,23B,76C 'user':91C 'vulner':70C 'write':11A,56B,98C","nicknames":[],"mitigations":[],"who_affected":"Systems running Synology DiskStation Manager versions before the fixed builds, where SNMP is part of the setup. The attacker must already hold administrator credentials on the NAS, so exposure is limited to environments where admin access is shared or compromised. Systems on patched DSM builds or with no admin accounts exposed can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dsm","infrastructure","medium","nas","snmp","synology"],"campaign_type":null,"search_a":"'-2026':14A,17A '-86343':15A,18A 'admin':8A 'api':4A 'crlf':5A 'cve':13A,16A 'dsm':2A 'file':12A 'flaw':6A 'let':7A 'read':9A 'snmp':3A 'synolog':1A 'write':11A","search_b":"'admin':51B 'administr':39B 'api':28B,47B 'arbitrari':57B 'attack':49B 'authent':38B 'break':43B 'caus':60B 'crlf':32B 'denial':61B 'diskstat':24B 'dsm':19B 'file':58B 'infrastructur':20B 'inject':41B 'input':35B 'line':42B 'manag':25B 'misus':45B 'nas':21B 'neutral':31B 'read':54B 'right':52B 'sequenc':33B 'servic':63B 'snmp':22B,27B 'synolog':23B 'write':56B","search_c":"'-1':87C '-5':83C '-86009':82C '-90080':86C '7.3.2':81C '7.4.1':85C 'administr':93C 'allow':88C 'api':74C 'arbitrari':99C 'attack':107C 'authent':90C 'conduct':102C 'crlf':68C 'denial':104C 'denial-of-servic':103C 'diskstat':77C 'dsm':79C 'file':100C 'improp':65C 'manag':78C 'neutral':66C 'privileg':94C 'read':96C 'remot':89C 'sequenc':69C 'servic':106C 'snmp':73C 'synolog':76C 'user':91C 'vulner':70C 'write':98C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T04:17:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@synology.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-86343","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86343","severity":null,"published_at":"2026-11-12T04:17:21+00:00","modified_at":"2026-11-12T04:17:21+00:00","first_seen_at":"2026-11-12T04:47:10+00:00","fetched_at":"2026-11-12T04:47:10+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}