Read the docs
TI-2010-02356 Aliases CVE-2010-2453GHSA-hjjc-2jc4-2pq4

Multiple cross-site scripting (XSS) vulnerabilities in Synology Disk Station 2.x before…

Priority LOW 22CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · Partial · None
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

Multiple cross-site scripting (XSS) vulnerabilities in Synology Disk Station 2.x before DSM3.0-1337 allow remote attackers to inject arbitrary web script or HTML by connecting to the FTP server and providing a crafted (1) USER or (2) PASS command, which is written by the FTP logging module to a web-interface log window, related to a "web commands injection" issue.

Why it matters now

EPSS 0.00856 58th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 22

CPEVersionsRoleVendor
cpe:2.3:o:synology:dsm:2.2-0942:*:*:*:*:*:*:*2.2-0942VulnerableSynology
cpe:2.3:o:synology:dsm:2.2-1041:*:*:*:*:*:*:*2.2-1041VulnerableSynology
cpe:2.3:o:synology:dsm:2.2-1042:*:*:*:*:*:*:*2.2-1042VulnerableSynology
cpe:2.3:o:synology:dsm:2.2-1045:*:*:*:*:*:*:*2.2-1045VulnerableSynology
cpe:2.3:o:synology:dsm:2.3-1139:*:*:*:*:*:*:*2.3-1139VulnerableSynology
cpe:2.3:o:synology:dsm:2.3-1141:*:*:*:*:*:*:*2.3-1141VulnerableSynology
cpe:2.3:o:synology:dsm:2.3-1144:*:*:*:*:*:*:*2.3-1144VulnerableSynology
cpe:2.3:o:synology:dsm:2.3-1157:*:*:*:*:*:*:*2.3-1157VulnerableSynology
cpe:2.3:o:synology:dsm:2.3-1161:*:*:*:*:*:*:*2.3-1161VulnerableSynology
cpe:2.3:o:synology:dsm:3.0-1334:*:*:*:*:*:*:*3.0-1334VulnerableSynology
  • cpe:2.3:o:synology:dsm:2.2-0942:*:*:*:*:*:*:* Versions 2.2-0942 Vulnerable ·Synology
  • cpe:2.3:o:synology:dsm:2.2-1041:*:*:*:*:*:*:* Versions 2.2-1041 Vulnerable ·Synology
  • cpe:2.3:o:synology:dsm:2.2-1042:*:*:*:*:*:*:* Versions 2.2-1042 Vulnerable ·Synology
  • cpe:2.3:o:synology:dsm:2.2-1045:*:*:*:*:*:*:* Versions 2.2-1045 Vulnerable ·Synology
  • cpe:2.3:o:synology:dsm:2.3-1139:*:*:*:*:*:*:* Versions 2.3-1139 Vulnerable ·Synology
  • cpe:2.3:o:synology:dsm:2.3-1141:*:*:*:*:*:*:* Versions 2.3-1141 Vulnerable ·Synology
  • cpe:2.3:o:synology:dsm:2.3-1144:*:*:*:*:*:*:* Versions 2.3-1144 Vulnerable ·Synology
  • cpe:2.3:o:synology:dsm:2.3-1157:*:*:*:*:*:*:* Versions 2.3-1157 Vulnerable ·Synology
  • cpe:2.3:o:synology:dsm:2.3-1161:*:*:*:*:*:*:* Versions 2.3-1161 Vulnerable ·Synology
  • cpe:2.3:o:synology:dsm:3.0-1334:*:*:*:*:*:*:* Versions 3.0-1334 Vulnerable ·Synology
Show 12 more CPE
CPEVersionsRoleVendor
cpe:2.3:h:synology:disk_station_ds1010\+:*:*:*:*:*:*:*:*all versionsRunning onSynology
cpe:2.3:h:synology:disk_station_ds109:*:*:*:*:*:*:*:*all versionsRunning onSynology
cpe:2.3:h:synology:disk_station_ds110\+:*:*:*:*:*:*:*:*all versionsRunning onSynology
cpe:2.3:h:synology:disk_station_ds110j:*:*:*:*:*:*:*:*all versionsRunning onSynology
cpe:2.3:h:synology:disk_station_ds209:*:*:*:*:*:*:*:*all versionsRunning onSynology
cpe:2.3:h:synology:disk_station_ds210\+:*:*:*:*:*:*:*:*all versionsRunning onSynology
cpe:2.3:h:synology:disk_station_ds210j:*:*:*:*:*:*:*:*all versionsRunning onSynology
cpe:2.3:h:synology:disk_station_ds409slim:*:*:*:*:*:*:*:*all versionsRunning onSynology
cpe:2.3:h:synology:disk_station_ds410:*:*:*:*:*:*:*:*all versionsRunning onSynology
cpe:2.3:h:synology:disk_station_ds410j:*:*:*:*:*:*:*:*all versionsRunning onSynology
cpe:2.3:h:synology:disk_station_ds411\+:*:*:*:*:*:*:*:*all versionsRunning onSynology
cpe:2.3:h:synology:disk_station_ds710\+:*:*:*:*:*:*:*:*all versionsRunning onSynology
  • cpe:2.3:h:synology:disk_station_ds1010\+:*:*:*:*:*:*:*:* Versions all versions Running on ·Synology
  • cpe:2.3:h:synology:disk_station_ds109:*:*:*:*:*:*:*:* Versions all versions Running on ·Synology
  • cpe:2.3:h:synology:disk_station_ds110\+:*:*:*:*:*:*:*:* Versions all versions Running on ·Synology
  • cpe:2.3:h:synology:disk_station_ds110j:*:*:*:*:*:*:*:* Versions all versions Running on ·Synology
  • cpe:2.3:h:synology:disk_station_ds209:*:*:*:*:*:*:*:* Versions all versions Running on ·Synology
  • cpe:2.3:h:synology:disk_station_ds210\+:*:*:*:*:*:*:*:* Versions all versions Running on ·Synology
  • cpe:2.3:h:synology:disk_station_ds210j:*:*:*:*:*:*:*:* Versions all versions Running on ·Synology
  • cpe:2.3:h:synology:disk_station_ds409slim:*:*:*:*:*:*:*:* Versions all versions Running on ·Synology
  • cpe:2.3:h:synology:disk_station_ds410:*:*:*:*:*:*:*:* Versions all versions Running on ·Synology
  • cpe:2.3:h:synology:disk_station_ds410j:*:*:*:*:*:*:*:* Versions all versions Running on ·Synology
  • cpe:2.3:h:synology:disk_station_ds411\+:*:*:*:*:*:*:*:* Versions all versions Running on ·Synology
  • cpe:2.3:h:synology:disk_station_ds710\+:*:*:*:*:*:*:*:* Versions all versions Running on ·Synology

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2010-2453
  2. 2026-10-03 Alias added: GHSA-hjjc-2jc4-2pq4

References

—

  • TI-2010-03508 The FTP authentication module in Synology Disk Station 2.x logs passwords to the web… CVSS 2.0LOW 2.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences