---
id: "CVE-2026-86343"
page: "https://infrastack.ai/live/CVE-2026-86343"
kind: "vulnerability"
aliases: ["CVE-2026-86343"]
title: "Synology DSM: SNMP API CRLF flaw lets admins read or write files"
severity: "medium"
cvss: 6.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["dsm", "infrastructure", "nas", "snmp", "synology"]
not_affected_if: ["no-admin-exposure", "patched-dsm"]
published_at: "2026-11-12T04:17:21+00:00"
first_seen_at: "2026-11-12T04:47:10+00:00"
updated_at: "2026-11-12T04:47:48+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86343", "first_seen_at": "2026-11-12T04:47:10+00:00"}]
exploit_sources: []
---

# Synology DSM: SNMP API CRLF flaw lets admins read or write files

Link for people: https://infrastack.ai/live/CVE-2026-86343 (this .md is for agents)

DiskStation Manager's SNMP API does not neutralize CRLF sequences in input, so an authenticated administrator can inject line breaks and misuse the API. An attacker with admin rights can read or write arbitrary files and cause denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed DSM version in Control Panel > Info Center and compare it with the fixed versions below.
- Confirm whether SNMP is enabled in Control Panel > Terminal & SNMP.

## Fix

- DSM before `7.3.2-86009-5` is affected; move to `7.3.2-86009-5` or later on the 7.3 branch.
- DSM before `7.4.1-90080-1` is affected; move to `7.4.1-90080-1` or later on the 7.4 branch.

## Timeline

- 2026-11-12T04:47:10+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-86343

## From the sources

An improper neutralization of CRLF sequences vulnerability in the SNMP API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users with administrator privileges to read or write arbitrary files and conduct denial-of-service attacks.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_