[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-synology-patches-two-dsm-flaws-one-rated-98-out-of-10":10,"sections":41},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":30,"tags":31,"sources":36,"feedback":40,"feedback_at":22,"cost_usd":40,"total_tokens":40},12871,"synology-patches-two-dsm-flaws-one-rated-98-out-of-10","Synology Patches Two DSM Flaws, One Rated 9.8 Out of 10","Synology fixed a 9.8-rated SQL injection bug and an 8.6-rated rsync bypass in DSM, so NAS owners should confirm the update actually installed.","If you run a Synology NAS, check that its DiskStation Manager (DSM) operating system has installed the latest update. Synology has patched two vulnerabilities, and the worse one is rated 9.8 out of 10 on the CVSS3 severity scale, which puts it in the \"critical\" tier. Check Synology's advisory for the affected versions and the fixed build numbers that apply to your model.\n\nThe critical bug is an SQL injection flaw in the DSM Auth API. SQL injection means a system treats attacker-supplied text as a database command. Synology said it \"allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks.\" International Cyber Digest, a security account on X, said on November 11 that it works without logging in, and that Synology patched both flaws that day.\n\nThe second flaw scores 8.6. Synology describes it as an authentication bypass using an alternate path or channel in rsync, the file-sync tool, and says it can also lead to unwanted reads, writes and denial-of-service attacks. In plain terms, one bug breaks the login code and the other walks around it.\n\nThe location of the first flaw is what makes it serious. The Auth API is the code that decides who gets in, so a mistake there sits at the front door. A NAS often holds the backups and archives people can least afford to lose, which raises the cost of a break-in well beyond one machine.\n\nThis is separate from the ransomware warning Synology sent users late last month. That notice concerned attacks related to a 2024 security advisory covering a different set of vulnerabilities. Many users have reportedly already received the new update, but automatic updaters are far from perfect, so a manual look at the installed DSM version is a few minutes well spent.","[\"synology\",\"nas\",\"vulnerability\",\"dsm\"]","2026-11-11T17:24:05.000Z","2026-11-11T17:45:32.658Z","2026-11-11T17:45:35.293Z","published",null,[24],{"id":25,"reviewer":26,"round":27,"reason":28,"status":29},"editor-r1","editor",1,"Name International Cyber Digest instead of 'one security account on X', cut the meta line 'The material available here does not list affected versions or say whether attackers are exploiting either flaw' (say plainly that Synology's advisory should be checked for affected versions), and drop or source the speculative claim that two rounds of warnings show NAS boxes are 'a recurring target'.","resolved","security",[32,33,34,35],"synology","nas","vulnerability","dsm",[37],{"name":38,"url":39},"PCGamer","https:\u002F\u002Fwww.pcgamer.com\u002Fhardware\u002Fstorage\u002Fgot-a-synology-nas-time-to-check-your-updates-as-two-high-level-vulnerabilities-let-neer-do-wells-read-and-write-files-and-conduct-ddos-attacks\u002F",0,{"sections":42},[43,48,52,57,62,67,72,77,82,87,92,97,102,107],{"name":44,"slug":45,"count":46,"latest_published_at":47},"AI","ai",7144,"2026-11-12T13:27:45.000Z",{"name":49,"slug":30,"count":50,"latest_published_at":51},"Security",1128,"2026-11-11T18:05:00.000Z",{"name":53,"slug":54,"count":55,"latest_published_at":56},"Deals","deals",642,"2026-11-12T14:00:00.000Z",{"name":58,"slug":59,"count":60,"latest_published_at":61},"Policy","policy",619,"2026-11-12T12:53:36.000Z",{"name":63,"slug":64,"count":65,"latest_published_at":66},"Consumer Tech","consumer-tech",364,"2026-11-12T11:12:32.000Z",{"name":68,"slug":69,"count":70,"latest_published_at":71},"Hardware","hardware",336,"2026-11-12T11:24:43.000Z",{"name":73,"slug":74,"count":75,"latest_published_at":76},"Science","science",230,"2026-11-12T10:00:00.000Z",{"name":78,"slug":79,"count":80,"latest_published_at":81},"Software","software",168,"2026-11-11T17:36:49.000Z",{"name":83,"slug":84,"count":85,"latest_published_at":86},"Startups","startups",159,"2026-11-11T12:30:00.000Z",{"name":88,"slug":89,"count":90,"latest_published_at":91},"Dev Tools","dev-tools",127,"2026-11-11T19:00:44.000Z",{"name":93,"slug":94,"count":95,"latest_published_at":96},"General","general",118,"2026-11-11T16:49:42.000Z",{"name":98,"slug":99,"count":100,"latest_published_at":101},"Gaming","gaming",107,"2026-11-12T10:09:03.000Z",{"name":103,"slug":104,"count":105,"latest_published_at":106},"Reviews","reviews",38,"2026-10-20T12:00:00.000Z",{"name":108,"slug":109,"count":110,"latest_published_at":111},"How-To","how-to",8,"2026-10-05T09:00:00.000Z"]