The FTP authentication module in Synology Disk Station 2.x logs passwords to the web…
Priority LOW 11CWE-255Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Partial · None · None
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA.
Summary
The FTP authentication module in Synology Disk Station 2.x logs passwords to the web application interface in cases of incorrect login attempts, which allows local users to obtain sensitive information by reading a log, a different vulnerability than CVE-2010-2453.
Why it matters now
EPSS 0.00308 23rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 21
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:synology:dsm:2.2-0942:*:*:*:*:*:*:* | 2.2-0942 | Vulnerable | Synology |
| cpe:2.3:o:synology:dsm:2.2-1041:*:*:*:*:*:*:* | 2.2-1041 | Vulnerable | Synology |
| cpe:2.3:o:synology:dsm:2.2-1042:*:*:*:*:*:*:* | 2.2-1042 | Vulnerable | Synology |
| cpe:2.3:o:synology:dsm:2.2-1045:*:*:*:*:*:*:* | 2.2-1045 | Vulnerable | Synology |
| cpe:2.3:o:synology:dsm:2.3-1139:*:*:*:*:*:*:* | 2.3-1139 | Vulnerable | Synology |
| cpe:2.3:o:synology:dsm:2.3-1141:*:*:*:*:*:*:* | 2.3-1141 | Vulnerable | Synology |
| cpe:2.3:o:synology:dsm:2.3-1144:*:*:*:*:*:*:* | 2.3-1144 | Vulnerable | Synology |
| cpe:2.3:o:synology:dsm:2.3-1157:*:*:*:*:*:*:* | 2.3-1157 | Vulnerable | Synology |
| cpe:2.3:o:synology:dsm:2.3-1161:*:*:*:*:*:*:* | 2.3-1161 | Vulnerable | Synology |
| cpe:2.3:h:synology:disk_station_ds1010\+:*:*:*:*:*:*:*:* | all versions | Running on | Synology |
- cpe:2.3:o:synology:dsm:2.2-0942:*:*:*:*:*:*:* Versions 2.2-0942 Vulnerable ·Synology
- cpe:2.3:o:synology:dsm:2.2-1041:*:*:*:*:*:*:* Versions 2.2-1041 Vulnerable ·Synology
- cpe:2.3:o:synology:dsm:2.2-1042:*:*:*:*:*:*:* Versions 2.2-1042 Vulnerable ·Synology
- cpe:2.3:o:synology:dsm:2.2-1045:*:*:*:*:*:*:* Versions 2.2-1045 Vulnerable ·Synology
- cpe:2.3:o:synology:dsm:2.3-1139:*:*:*:*:*:*:* Versions 2.3-1139 Vulnerable ·Synology
- cpe:2.3:o:synology:dsm:2.3-1141:*:*:*:*:*:*:* Versions 2.3-1141 Vulnerable ·Synology
- cpe:2.3:o:synology:dsm:2.3-1144:*:*:*:*:*:*:* Versions 2.3-1144 Vulnerable ·Synology
- cpe:2.3:o:synology:dsm:2.3-1157:*:*:*:*:*:*:* Versions 2.3-1157 Vulnerable ·Synology
- cpe:2.3:o:synology:dsm:2.3-1161:*:*:*:*:*:*:* Versions 2.3-1161 Vulnerable ·Synology
- cpe:2.3:h:synology:disk_station_ds1010\+:*:*:*:*:*:*:*:* Versions all versions Running on ·Synology
Show 11 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:h:synology:disk_station_ds109:*:*:*:*:*:*:*:* | all versions | Running on | Synology |
| cpe:2.3:h:synology:disk_station_ds110\+:*:*:*:*:*:*:*:* | all versions | Running on | Synology |
| cpe:2.3:h:synology:disk_station_ds110j:*:*:*:*:*:*:*:* | all versions | Running on | Synology |
| cpe:2.3:h:synology:disk_station_ds209:*:*:*:*:*:*:*:* | all versions | Running on | Synology |
| cpe:2.3:h:synology:disk_station_ds210\+:*:*:*:*:*:*:*:* | all versions | Running on | Synology |
| cpe:2.3:h:synology:disk_station_ds210j:*:*:*:*:*:*:*:* | all versions | Running on | Synology |
| cpe:2.3:h:synology:disk_station_ds409slim:*:*:*:*:*:*:*:* | all versions | Running on | Synology |
| cpe:2.3:h:synology:disk_station_ds410:*:*:*:*:*:*:*:* | all versions | Running on | Synology |
| cpe:2.3:h:synology:disk_station_ds410j:*:*:*:*:*:*:*:* | all versions | Running on | Synology |
| cpe:2.3:h:synology:disk_station_ds411\+:*:*:*:*:*:*:*:* | all versions | Running on | Synology |
| cpe:2.3:h:synology:disk_station_ds710\+:*:*:*:*:*:*:*:* | all versions | Running on | Synology |
- cpe:2.3:h:synology:disk_station_ds109:*:*:*:*:*:*:*:* Versions all versions Running on ·Synology
- cpe:2.3:h:synology:disk_station_ds110\+:*:*:*:*:*:*:*:* Versions all versions Running on ·Synology
- cpe:2.3:h:synology:disk_station_ds110j:*:*:*:*:*:*:*:* Versions all versions Running on ·Synology
- cpe:2.3:h:synology:disk_station_ds209:*:*:*:*:*:*:*:* Versions all versions Running on ·Synology
- cpe:2.3:h:synology:disk_station_ds210\+:*:*:*:*:*:*:*:* Versions all versions Running on ·Synology
- cpe:2.3:h:synology:disk_station_ds210j:*:*:*:*:*:*:*:* Versions all versions Running on ·Synology
- cpe:2.3:h:synology:disk_station_ds409slim:*:*:*:*:*:*:*:* Versions all versions Running on ·Synology
- cpe:2.3:h:synology:disk_station_ds410:*:*:*:*:*:*:*:* Versions all versions Running on ·Synology
- cpe:2.3:h:synology:disk_station_ds410j:*:*:*:*:*:*:*:* Versions all versions Running on ·Synology
- cpe:2.3:h:synology:disk_station_ds411\+:*:*:*:*:*:*:*:* Versions all versions Running on ·Synology
- cpe:2.3:h:synology:disk_station_ds710\+:*:*:*:*:*:*:*:* Versions all versions Running on ·Synology
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2010-3684
- 2026-10-03 Alias added: GHSA-6g39-3h52-rrwg
References
—
More Synology Dsm vulnerabilities
- TI-2010-02356 Multiple cross-site scripting (XSS) vulnerabilities in Synology Disk Station 2.x before… CVSS 2.0MEDIUM 4.3
Sources
- CVE-2010-3684 · CVE Program
- CVE-2010-3684 · NVD
- FIRST EPSS
- GHSA-6g39-3h52-rrwg · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences