- Top reward
- $30,000
- Top severity paid
- Not published
- Assets in scope
- 36
- Public CVEs
- 60
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $30,000
- top reward.
- Report by email
- [email protected] with https://www.synology.com/de-de/support/security_pgp_key
- No safe harbor
- No promise about legal action.
- Replies within 7 days
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
The policy page has no reward table. Here is what it says, in its own words.
- Top reward
-
$30,000
Prämien von bis zu 30.000 US-Dollar.
- Response
-
Within 7 days
Das Synology Security Team wird innerhalb von 7 Tagen auf Ihre Meldung reagieren
- Hall of fame
-
Yes
Qualifiziert sich Ihr Schwachstellen-Bericht für eine Prämie, wird Ihr Name als Zeichen unserer Dankbarkeit und Wertschätzung auf der Synology Produkt-Sicherheitsanweisungen Seite aufgeführt.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
36 assets you may test, 3 excluded.
Desktop and binaries 9
- BeeStation OS 1.0 (latest version)
- DiskStation Manager (DSM)
- DSM 7 (latest version)
- Firmware 1.1 (latest version)
- Operating systems
- Packages
- SRM 1.3 (latest version)
- Synology Camera firmware
- Synology-developed software packages
Wildcard domains 8
- *.account.synology.com
- *.c2.synology.com
- *.c2.synology.com-domains
- *.identity.synology.com
- *.identity.synology.com-domains
- *.konto.synology.de-domänen
- *.synology.com
- *.synology.com-domains
Domains 4
- c2.synology.com
- identity.synology.com
- konto.synology.de
- synology.com
Android apps 2
- Mobile apps
- Von Synology entwickelte mobile Anwendungen für Android und iOS
Hardware and IoT 1
- Synology Kamera Firmware Firmware 1.1 (aktuellste Version)
iOS apps 1
- Synology-developed mobile apps for Android and iOS
Products and areas 11
- C2 services
- Desktop clients
- DiskStation Manager (DSM) DSM 7 (neueste Version)
- Standardmäßig installierte Pakete
- Synology Account
- Synology BeeStation
- Synology BeeStation BeeStation OS 1.0 (neueste Version)
- Synology-developed Windows, macOS, and Linux applications
- Synology Router Manager (SRM)
- Von Synology entwickelte Softwarepakete
- Von Synology entwickelte Windows-, macOS- und Linux-Anwendungen
Out of scope (3)
- ask.synology.com
- openstack-ci-logs.synology.com
- router.synology.com
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Synology's policy.
While testing
-
Verwenden Sie diesen PGP-Schlüssel , um Ihre Informationen zu verschlüsseln, wenn Sie Fehlerberichte an Synology senden.
-
Fügen Sie einen detaillierten PoC (Proof of Concept) bei und stellen Sie sicher, dass die gemeldeten Probleme reproduziert werden können.
-
Der Bericht muss in englischer Sprache verfasst sein.
-
Aktionen, die möglicherweise Synology Server oder Daten beschädigen oder nachteilig beeinflussen könnten, sind strengstens untersagt.
-
Die Schwachstellentests dürfen nicht gegen lokale oder taiwanesische Gesetze verstoßen.
-
Bitte benachrichtigen Sie uns, bevor Sie Bug-Informationen öffentlich bekannt geben.
-
Die private Weitergabe einer Sicherheitslücke an Dritte zu anderen Zwecken als der Fehlerbehebung steht im Widerspruch zum Geist unseres Programms.
Not accepted
-
DoS-(Denial-of-Service-)Angriffe auf die Server von Synology oder Benutzern
-
Schwachstellentests, die den Servern oder Daten von Synology oder Benutzern schaden
-
Physische Angriffe oder Social Engineering
-
Veröffentlichung von Informationen zu Fehlern vor der Genehmigung durch Synology
-
Nicht kritische Schwachstellen in veralteten oder nicht mehr unterstützten (EOL-)Diensten oder -Produkten
-
Schwachstellen, die nur veraltete Webbrowser betreffen
-
Die meisten Arten von Brute-Force-Angriffen
-
Reflektierte XSS-Angriffe oder Self-XSS-Angriffe
-
Schwachstellen im Zusammenhang mit Phishing, der Erstellung gefälschter Websites oder Betrug
-
Schwachstellenscanberichte, in denen die Auswirkungen der Schwachstelle nicht ausführlich beschrieben werden
-
Hinweise darauf, dass Standardports verwundbar sind, ohne einen PoC bereitzustellen
-
Theoretische Schwachstellen ohne konkreten Proof of Concept (PoC)
-
Fehlende Sicherheits-Header, die nicht direkt zur Ausnutzung führen
-
Fehlende Sicherheits-Flags in Cookies
-
Die Ursache liegt im Upstream-Open-Source-Code oder bei Drittanbietern und nicht in von Synology vorgenommenen Änderungen.
-
Probleme, die eine Man-in-the-Middle-(MITM-)Position oder Kontrolle über den Netzwerkverkehr eines Benutzers erfordern.
-
Lokale Probleme bei der Rechteerweiterung, die nicht mit einer gültigen Netzwerkschwachstelle verkettet sind.
-
Berichte, die auf QEMU oder anderen emulierten Umgebungen basieren.
-
Directory Traversal auf https://*archive.synology.com
-
Reflected File Download
-
Probleme beim Auslesen von Bannern oder bei der Offenlegung von Softwareversionen
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 5 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-4793 | An incorrect default permissions vulnerability in Synology Assistant before 7.0.7-50095 allows local users to read or write arbitrary files and conduct denial-of-service during installation. | High 7.3 | 3 Aug 2026 |
| CVE-2022-49042 | An inclusion of functionality from untrusted control sphere vulnerability in MinGW DLL component in Synology Hyper Backup Explorer before 3.0.1-0156 allows local users to execute arbitrary code via unspecified vectors. | High 7.8 | 3 Jun 2026 |
| CVE-2023-52951 | A cleartext transmission of sensitive information vulnerability in Synology Note Station Client before 2.2.4-703 allows man-in-the-middle attackers to obtain user credential. | Medium 5.9 | 3 Jun 2026 |
| CVE-2024-47263 | An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in Backup.Repository webapi component in Synology Hyper Backup before 4.1.2-4036 allows remote authenticated users with administrator privileges to write specific files containing non-sensitive information via unspecified vectors. | Medium 4.1 | 3 Jun 2026 |
| CVE-2024-47273 | An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in Backup Task functionality in Synology Hyper Backup before 4.1.2-4036 allows remote authenticated users to write specific files via unspecified vectors. | Medium 4.3 | 3 Jun 2026 |
| CVE-2022-49036 | An inclusion of functionality from untrusted control sphere vulnerability in OpenSSL configuration in Synology Active Backup for Business Recovery Media Creator before 2.5.0-2081 allows local users to execute arbitrary code via unspecified vectors. | High 7.8 | 3 Jun 2026 |
| CVE-2025-66592 | An origin validation error vulnerability in Synology Active Backup for Business Agent before 3.1.0-4967 allows local users to write arbitrary files with restricted content and conduct denial-of-service during installation. | Medium 6.1 | 27 May 2026 |
| CVE-2025-66593 | An origin validation error vulnerability in Synology Assistant before 7.0.6-50085 allows local users to write arbitrary files with restricted content and conduct denial-of-service during installation. | Medium 6.1 | 27 May 2026 |
| CVE-2026-2237 | A use of get request method with sensitive query strings vulnerability in volume encryption of Synology Storage Manager package before 1.0.1-1100 allows local users on Windows to obtain sensitive information. | Medium 6.2 | 27 May 2026 |
| CVE-2025-13392 | Improper check for unusual or exceptional conditions vulnerability in SSO in Synology DiskStation Manager (DSM) before 7.2.2-72806-5 and 7.3.1-86003-1 (7.2.1-69057 is not affected) allows remote attackers to bypass authentication with prior knowledge of the distinguished name (DN). | High 8.1 | 27 May 2026 |
| CVE-2025-13593 | Origin validation error vulnerability in Synology ActiveProtect Agent before 1.1.0-0439 allows local users to write arbitrary files with restricted content and conduct denial-of-service during installation. | Medium 6.1 | 27 May 2026 |
| CVE-2025-14713 | An Exposed Dangerous Method or Function vulnerability in Synology C2 Identity Edge Server package in DSM before 1.76.0-0307 allows remote attackers to obtain user credentials from the edge server. | High 7.5 | 27 May 2026 |
| CVE-2025-30028 | A vulnerability in Active Backup for Business allows unauthorized remote attackers to read arbitrary files. | High 8.6 | 27 May 2026 |
| CVE-2024-47268 | Missing authorization vulnerability in AddOns functionality in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 allows remote authenticated users with administrator privileges to obtain sensitive information via unspecified vectors. | Medium 4.9 | 27 May 2026 |
| CVE-2024-47269 | Cleartext transmission of sensitive information vulnerability in Export Key functionality in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 allows remote authenticated users with administrator privileges to obtain sensitive information via unspecified vectors. | Medium 4.9 | 27 May 2026 |
| CVE-2024-47270 | Improper preservation of permissions vulnerability in Archiving Push functionality in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 allows remote authenticated users with administrator privileges to limited file write via unspecified vectors. | Low 2.7 | 27 May 2026 |
| CVE-2024-47271 | Insufficiently protected credentials vulnerability in IPSpeaker component in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 allows remote authenticated users with administrator privileges to obtain sensitive information via unspecified vectors. | Medium 4.9 | 27 May 2026 |
| CVE-2024-47272 | Incorrect authorization vulnerability in IO Module functionality in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 allows remote authenticated users with administrator privileges to limited file write via unspecified vectors. | Low 2.7 | 27 May 2026 |
| CVE-2025-10466 | Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Safe Access in Synology Safe Access before 1.3.1-0329 allows remote authenticated users with administrator privileges to read or write specific files containing non-sensitive information or conduct limited denial-of-service in SRM. | Medium 5.9 | 27 May 2026 |
| CVE-2025-12686 | Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in AdminCenter in Synology BeeStation OS before 1.3.2-65648 allows remote attackers to execute arbitrary code via unspecified vectors. | Critical 9.8 | 27 May 2026 |
| CVE-2025-13167 | Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in contact functionality in Synology Contacts before 1.0.10-20659 allows remote authenticated users to read or write specific files containing non-sensitive information via unspecified vectors. | Medium 5.4 | 27 May 2026 |
| CVE-2023-52945 | Uncontrolled search path element vulnerability in OpenSSL DLL component in Synology BeeDrive for desktop before 1.3.2-13814 allows local users to execute arbitrary code via unspecified vectors. | High 7.8 | 27 May 2026 |
| CVE-2024-11399 | Files or directories accessible to external parties vulnerability in redis-server component in Synology BeeDrive for desktop before 1.3.2-13814 allows local users to conduct denial-of-service attacks via unspecified vectors. | Medium 6.8 | 27 May 2026 |
| CVE-2024-47267 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in Archiving Pull functionality in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 allows remote authenticated users with administrator privileges to limited file write via unspecified vectors. | Low 2.7 | 27 May 2026 |
| CVE-2021-47961 | A plaintext storage of a password vulnerability in Synology SSL VPN Client before 1.4.5-0684 allows remote attackers to access or influence the user's PIN code due to insecure storage. This may lead to unauthorized VPN configuration and potential interception of subsequent VPN traffic when combined with user interaction. | High 8.1 | 10 Apr 2026 |
| CVE-2021-47960 | A files or directories accessible to external parties vulnerability in Synology SSL VPN Client before 1.4.5-0684 allows remote attackers to access files within the installation directory via a local HTTP server bound to the loopback interface. By leveraging user interaction with a crafted web page, attackers may retrieve sensitive files such as configuration files, certificates, and logs, leading | Medium 6.5 | 10 Apr 2026 |
| CVE-2026-3091 | An uncontrolled search path element vulnerability in Synology Presto Client before 2.1.3-0672 allows local users to read or write arbitrary files and conduct denial-of-service during installation by placing a malicious DLL in advance in the same directory as the installer. | Medium 6.7 | 24 Feb 2026 |
| CVE-2025-8074 | Origin validation error vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.3-13973 allows local users to write arbitrary files with non-sensitive information via unspecified vectors. | Medium 5.6 | 4 Dec 2025 |
| CVE-2025-54158 | Missing authentication for critical function vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.2-13960 allows local users to execute arbitrary code via unspecified vectors. | High 7.8 | 4 Dec 2025 |
| CVE-2025-54159 | Missing authorization vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.2-13960 allows remote attackers to delete arbitrary files via unspecified vectors. | High 7.5 | 4 Dec 2025 |
| CVE-2025-54160 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.2-13960 allows local users to execute arbitrary code via unspecified vectors. | High 7.8 | 4 Dec 2025 |
| CVE-2025-29845 | A vulnerability in VideoPlayer2 subtitle cgi allows remote authenticated users to read .srt files. | Medium 4.3 | 4 Dec 2025 |
| CVE-2025-29846 | A vulnerability in portenable cgi allows remote authenticated users to get the status of installed packages. | High 7.2 | 4 Dec 2025 |
| CVE-2025-2848 | A vulnerability in Synology Mail Server allows remote authenticated attackers to read and write non-sensitive settings, and disable some non-critical functions. | Medium 6.3 | 4 Dec 2025 |
| CVE-2025-29843 | A vulnerability in FileStation thumb cgi allows remote authenticated users to read/write image files. | Medium 5.4 | 4 Dec 2025 |
| CVE-2025-29844 | A vulnerability in FileStation file cgi allows remote authenticated users to read file metadata and path information. | Medium 4.3 | 4 Dec 2025 |
| CVE-2024-45539 | Out-of-bounds write vulnerability in cgi components in Synology DiskStation Manager (DSM) before 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote attackers to conduct denial-of-service attacks via unspecified vectors. | High 7.5 | 4 Dec 2025 |
| CVE-2024-5401 | Improper control of dynamically-managed code resources vulnerability in WebAPI component in Synology DiskStation Manager (DSM) before 7.1.1-42962-8 and 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote authenticated users to obtain privileges without consent via unspecified vectors. | Medium 4.3 | 4 Dec 2025 |
| CVE-2024-45538 | Cross-Site Request Forgery (CSRF) vulnerability in WebAPI Framework in Synology DiskStation Manager (DSM) before 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote attackers to execute arbitrary code via unspecified vectors. | Critical 9.6 | 4 Dec 2025 |
| CVE-2024-53287 | Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in VPN Setting functionality in Synology Router Manager (SRM) before 1.3.1-9346-11 allows remote authenticated users with administrator privileges to inject arbitrary web script or HTML via unspecified vectors. | Medium 5.9 | 23 Jul 2025 |
| CVE-2024-53288 | Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in NTP Region functionality in Synology Router Manager (SRM) before 1.3.1-9346-11 allows remote authenticated users with administrator privileges to inject arbitrary web script or HTML via unspecified vectors. | Medium 5.9 | 23 Jul 2025 |
| CVE-2024-53286 | Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in DDNS Record functionality in Synology Router Manager (SRM) before 1.3.1-9346-11 allows remote authenticated users with administrator privileges to execute arbitrary code via unspecified vectors. | High 7.2 | 23 Jul 2025 |
| CVE-2025-4679 | A vulnerability in Synology Active Backup for Microsoft 365 allows remote authenticated attackers to obtain sensitive information via unspecified vectors. | Medium 6.5 | 16 May 2025 |
| CVE-2025-1021 | Missing authorization vulnerability in synocopy in Synology DiskStation Manager (DSM) before 7.1.1-42962-8, 7.2.1-69057-7 and 7.2.2-72806-3 allows remote attackers to read arbitrary files via unspecified vectors. | High 7.5 | 23 Apr 2025 |
| CVE-2024-50630 | Missing authentication for critical function vulnerability in the webapi component in Synology Drive Server before 3.0.4-12699, 3.2.1-23280, 3.5.0-26085 and 3.5.1-26102 allows remote attackers to obtain administrator credentials via unspecified vectors. | High 7.5 | 19 Mar 2025 |
| CVE-2024-50631 | Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in the system syncing daemon in Synology Drive Server before 3.0.4-12699, 3.2.1-23280, 3.5.0-26085 and 3.5.1-26102 allows remote attackers to inject SQL commands, limited to write operations, via unspecified vectors. | High 7.5 | 19 Mar 2025 |
| CVE-2024-50629 | Improper encoding or escaping of output vulnerability in the webapi component in Synology BeeStation OS (BSM) before 1.1-65374 and Synology DiskStation Manager (DSM) before 7.1.1-42962-7, 7.2-64570-4, 7.2.1-69057-6 and 7.2.2-72806-1 allow remote attackers to read limited files via unspecified vectors. | Medium 5.3 | 19 Mar 2025 |
| CVE-2024-11131 | A vulnerability regarding out-of-bounds read is found in the video interface. This allows remote attackers to execute arbitrary code via unspecified vectors. The following models with Synology Camera Firmware versions before 1.2.0-0525 may be affected: BC500, CC400W and TC500. | Critical 9.8 | 19 Mar 2025 |
| CVE-2024-10442 | Off-by-one error vulnerability in the transmission component in Synology Replication Service before 1.0.12-0066, 1.2.2-0353 and 1.3.0-0423 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote attackers to execute arbitrary code, potentially leading to a broader impact across the system via unspecified vectors. | Critical 10.0 | 19 Mar 2025 |
| CVE-2024-10444 | Improper certificate validation vulnerability in the LDAP utilities in Synology DiskStation Manager (DSM) before 7.1.1-42962-8, 7.2.1-69057-7 and 7.2.2-72806-3 allows man-in-the-middle attackers to hijack the authentication of administrators via unspecified vectors. | High 7.5 | 19 Mar 2025 |
| CVE-2024-10445 | Improper certificate validation vulnerability in the update functionality in Synology BeeStation OS (BSM) before 1.1-65374 and Synology DiskStation Manager (DSM) before 6.2.4-25556-8, 7.1.1-42962-7, 7.2-64570-4, 7.2.1-69057-6 and 7.2.2-72806-1 allow remote attackers to write limited files via unspecified vectors. | Medium 4.3 | 19 Mar 2025 |
| CVE-2024-10441 | Improper encoding or escaping of output vulnerability in the system plugin daemon in Synology BeeStation OS (BSM) before 1.1-65374 and Synology DiskStation Manager (DSM) before 7.2-64570-4, 7.2.1-69057-6 and 7.2.2-72806-1 allows remote attackers to execute arbitrary code via unspecified vectors. | Critical 9.8 | 19 Mar 2025 |
| CVE-2024-47264 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in agent-related functionality in Synology Active Backup for Business before 2.7.1-13234, 2.7.1-23234 and 2.7.1-3234 allows remote authenticated users with administrator privileges to delete arbitrary files via unspecified vectors. | Medium 4.9 | 13 Feb 2025 |
| CVE-2024-47265 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in encrypted share umount functionality in Synology Active Backup for Business before 2.7.1-13234, 2.7.1-23234 and 2.7.1-3234 allows remote authenticated users to write specific files via unspecified vectors. | Medium 6.5 | 13 Feb 2025 |
| CVE-2024-47266 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in share file list functionality in Synology Active Backup for Business before 2.7.1-13234, 2.7.1-23234 and 2.7.1-3234 allows remote authenticated users with administrator privileges to read specific files containing non-sensitive information via unspecified vectors. | Low 2.7 | 13 Feb 2025 |
| CVE-2024-4464 | Authorization bypass through user-controlled key vulnerability in streaming service in Synology Media Server before 1.4-2680, 2.0.5-3152 and 2.2.0-3325 allows remote attackers to read specific files via unspecified vectors. | High 7.5 | 18 Dec 2024 |
| CVE-2024-53282 | Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in WiFi Connect MAC Filter functionality in Synology Router Manager (SRM) before 1.3.1-9346-10 allows remote authenticated users with administrator privileges to read or write specific files containing non-sensitive information and conduct limited denial-of-service attacks by injecting arbitrary web | Medium 5.9 | 9 Dec 2024 |
| CVE-2024-53283 | Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Router Port Forward functionality in Synology Router Manager (SRM) before 1.3.1-9346-10 allows remote authenticated users with administrator privileges to read or write specific files containing non-sensitive information and conduct limited denial-of-service attacks by injecting arbitrary web scri | Medium 5.9 | 9 Dec 2024 |
| CVE-2024-53284 | Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in WiFi Connect Setting functionality in Synology Router Manager (SRM) before 1.3.1-9346-10 allows remote authenticated users with administrator privileges to read or write specific files containing non-sensitive information and conduct limited denial-of-service attacks by injecting arbitrary web scr | Medium 5.9 | 9 Dec 2024 |
| CVE-2024-53285 | Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in DDNS Record functionality in Synology Router Manager (SRM) before 1.3.1-9346-10 allows remote authenticated users with administrator privileges to read or write specific files containing non-sensitive information and conduct limited denial-of-service attacks by injecting arbitrary web script or HT | Medium 5.9 | 9 Dec 2024 |