CVE-2026-13673 in DiskStation Manager
Summary
by MITRE • 09/18/2026
An incorrect permission assignment for critical resource vulnerability in LDAP API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users to read or write arbitrary files and conduct denial-of-service attacks.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified in Synology DiskStation Manager (DSM) versions prior to the specified patches represents a critical failure in access control mechanisms within the Lightweight Directory Access Protocol API implementation. This flaw, classified under CWE-284 as Improper Access Control, stems from an incorrect assignment of permissions for sensitive resources managed by the LDAP service. In these affected DSM releases, specifically 7.2.1 through 7.2.1-69057-12, 7.2.2 through 7.2.2-72806-9, 7.3.2 through 7.3.2-86009-4, and version 7.4 up to build 90075, the authentication layer fails to adequately restrict operations based on user privilege levels or resource sensitivity. Consequently, remote authenticated users who possess valid credentials for any account within the DSM environment can exploit this misconfiguration to bypass intended security boundaries. The core technical flaw involves the API endpoint accepting requests that modify or read files outside of their designated scope without verifying whether the requesting entity has sufficient administrative rights or specific authorization for those particular resources.
The operational impact of this vulnerability is severe, as it effectively allows an attacker with low-privileged access to escalate their capabilities significantly. By leveraging the improper permission assignment, a remote authenticated user can read arbitrary files from the underlying operating system. This capability facilitates unauthorized data exfiltration, potentially exposing sensitive configuration details, cryptographic keys, or personal information stored on the NAS device. Furthermore, the ability to write to arbitrary file locations enables an attacker to overwrite critical system binaries, configuration files, or log entries. Such modifications can lead to complete compromise of the host integrity, allowing for persistent backdoors or manipulation of audit trails. Additionally, the vulnerability supports denial-of-service attacks by enabling attackers to corrupt essential system files or consume excessive resources through malformed write operations, thereby disrupting availability for legitimate users and services hosted on the NAS infrastructure.
From a threat intelligence perspective, this exploitation aligns with ATT&CK techniques related to Privilege Escalation via Access Control Bypass and Data Exfiltration over Alternative Protocol. The attack vector is remote and requires authentication, which places it in the Initial Access or Persistence phases depending on how the compromised credentials were obtained. However, once authenticated, the lateral movement potential increases as the attacker gains deeper insight into the system architecture through file reads. This vulnerability underscores the importance of strict adherence to the principle of least privilege within network-attached storage management interfaces. Organizations relying on these DSM versions must recognize that standard user accounts are not sufficiently isolated from critical system resources due to this API flaw, creating a significant risk surface for both internal and external threats if credentials are compromised through phishing or credential stuffing attacks.
Mitigation strategies primarily involve immediate patching of the Synology DiskStation Manager software to one of the fixed versions mentioned in the advisory. Administrators should upgrade to DSM 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, or later builds of version 7.4 where the permission checks have been corrected in the LDAP API implementation. Until patches are applied, it is advisable to restrict network access to the DSM management interface and the specific ports used by the LDAP service using firewall rules, limiting exposure only to trusted IP addresses. Additionally, enforcing multi-factor authentication for all user accounts can reduce the likelihood of credential compromise that would precede exploitation of this vulnerability. Regular auditing of user permissions and reviewing logs for unusual file system access patterns can also help in detecting potential attempts to exploit this flaw before significant damage occurs.