Synology DiskStation Manager (DSM) before 6.2.3-25426-2 does not set the Secure flag for…
Priority LOW 27CWE-614Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- High
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-311.
Summary
Synology DiskStation Manager (DSM) before 6.2.3-25426-2 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session.
Why it matters now
EPSS 0.00559 46th percentileScored 2026-11-07
Fix Fixed DiskStation Manager (DSM) (Synology): 6.2.3-25426-2
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Synology | DiskStation Manager (DSM) | before 6.2.3-25426-2 | 6.2.3-25426-2 | Patch available | CNA |
- DiskStation Manager (DSM) VendorSynology Affected before 6.2.3-25426-2 Fixed in 6.2.3-25426-2 Patch available CNA
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:synology:diskstation_manager:*:*:*:*:*:*:*:* | 6.2 to before 6.2.3-25426-2 | Vulnerable | Synology |
| cpe:2.3:o:synology:skynas_firmware:*:*:*:*:*:*:*:* | before 6.2.3-25426 | Vulnerable | Synology |
| cpe:2.3:h:synology:skynas:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Synology |
- cpe:2.3:o:synology:diskstation_manager:*:*:*:*:*:*:*:* Versions 6.2 to before 6.2.3-25426-2 Vulnerable ·Synology
- cpe:2.3:o:synology:skynas_firmware:*:*:*:*:*:*:*:* Versions before 6.2.3-25426 Vulnerable ·Synology
- cpe:2.3:h:synology:skynas:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Synology
Remediation
- Fix · CNA DiskStation Manager (DSM) (Synology) Fixed in 6.2.3-25426-2
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Synology DiskStation Manager (DSM) 6.2.3-25426-2
4 records Highest priority Priority MEDIUM 1 MEDIUM, 3 LOW
Other records, highest priority first
- TI-2020-16763 Improper certificate validation in Synology DiskStation ManagerPriority MEDIUM 40
- TI-2020-16767 Broken or risky cryptographic algorithm in Synology DiskStation ManagerPriority LOW 38
- TI-2020-16771 Cleartext transmission of sensitive information in Synology DiskStation ManagerPriority LOW 30
Timeline
- 2026-10-02 Threatist record created from CVE-2020-27650
- 2026-10-03 Alias added: GHSA-pr6j-q8cq-rhhr
References
More Synology Diskstation Manager vulnerabilities
- TI-2021-02242 Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer… KEVCVSS 3.1HIGH 7.8
- TI-2018-01076 Out-of-bounds write in Netatalk CVSS 3.1CRITICAL 9.8
- TI-2017-10594 Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a… CVSS 3.1CRITICAL 9.8
- TI-2013-05716 webman/imageSelector.cgi in Synology DiskStation Manager (DSM) 4.0 before 4.0-2259, 4.2… CVSS 2.0HIGH 10.0
- TI-2021-19843 Out-of-bounds read in Samba CVSS 3.1HIGH 8.8
- TI-2017-11636 Command injection in Synology DiskStation Manager CVSS 3.0HIGH 8.8
Sources
- CVE-2020-27650 · CVE Program
- CVE-2020-27650 · NVD
- FIRST EPSS
- GHSA-pr6j-q8cq-rhhr · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences