CVE-2026-13639 - Vulnerability Details - OpenCVE

An insufficient entropy vulnerability in login logic in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact total

Vendors	Products
Synology	Diskstation Manager

No data.

No data.

References

Link	Providers
https://www.synology.com/en-global/security/advisory/Synology_SA_26_13

History

Sat, 19 Sep 2026 22:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Synology Synology diskstation Manager
Vendors & Products		Synology Synology diskstation Manager

Sat, 19 Sep 2026 21:15:00 +0000

Type	Values Removed	Values Added
Title	Insufficient Entropy in DSM Login Enables Remote File Access and Denial of Service

Sat, 19 Sep 2026 02:45:00 +0000

Type	Values Removed	Values Added
Title		Insufficient Entropy in DSM Login Enables Remote File Access and Denial of Service

Fri, 18 Sep 2026 21:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Fri, 18 Sep 2026 08:45:00 +0000

Type	Values Removed	Values Added
Description		An insufficient entropy vulnerability in login logic in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks.
Weaknesses		CWE-331
References		https://www.synology.com/en-global/security/advisory/Synology_SA_26_13
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: synology

Published: 2026-09-18T08:21:27.534Z

Updated: 2026-09-18T19:13:24.287Z

Reserved: 2026-06-29T09:59:06.873Z

Link: CVE-2026-13639

Vulnrichment

Updated: 2026-09-18T19:13:18.633Z

NVD

Status : Awaiting Analysis

Published: 2026-09-18T09:16:38.757

Modified: 2026-09-18T20:17:06.860

Link: CVE-2026-13639

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-13639", "assignerOrgId": "db201096-a0cc-46c7-9a55-61d9e221bf01", "state": "PUBLISHED", "assignerShortName": "synology", "dateReserved": "2026-06-29T09:59:06.873Z", "datePublished": "2026-09-18T08:21:27.534Z", "dateUpdated": "2026-09-18T19:13:24.287Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "product": "DiskStation Manager (DSM)", "vendor": "Synology", "versions": [{"lessThan": "7.4-90075", "status": "affected", "version": "7.4", "versionType": "semver"}, {"lessThan": "7.3.2-86009-4", "status": "affected", "version": "7.3.2", "versionType": "semver"}, {"lessThan": "7.2.2-72806-9", "status": "affected", "version": "7.2.2", "versionType": "semver"}, {"lessThan": "7.2.1-69057-12", "status": "affected", "version": "7.2.1", "versionType": "semver"}, {"lessThan": "7.2.1", "status": "unknown", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Lam Jun Rong (https://jro.sg)"}], "descriptions": [{"lang": "en", "value": "An insufficient entropy vulnerability in login logic in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-331", "description": "Insufficient Entropy", "lang": "en", "type": "CWE"}]}], "references": [{"name": "Synology-SA-26:13 DSM", "url": "https://www.synology.com/en-global/security/advisory/Synology_SA_26_13"}], "providerMetadata": {"orgId": "db201096-a0cc-46c7-9a55-61d9e221bf01", "shortName": "synology", "dateUpdated": "2026-09-18T08:21:27.534Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-18T19:13:10.452695Z", "id": "CVE-2026-13639", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-18T19:13:24.287Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-13639", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-09-18T19:13:10.452695Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-18T19:13:18.633Z"}}], "cna": {"credits": [{"lang": "en", "type": "finder", "value": "Lam Jun Rong (https://jro.sg)"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Synology", "product": "DiskStation Manager (DSM)", "versions": [{"status": "affected", "version": "7.4", "lessThan": "7.4-90075", "versionType": "semver"}, {"status": "affected", "version": "7.3.2", "lessThan": "7.3.2-86009-4", "versionType": "semver"}, {"status": "affected", "version": "7.2.2", "lessThan": "7.2.2-72806-9", "versionType": "semver"}, {"status": "affected", "version": "7.2.1", "lessThan": "7.2.1-69057-12", "versionType": "semver"}, {"status": "unknown", "version": "0", "lessThan": "7.2.1", "versionType": "semver"}], "defaultStatus": "affected"}], "references": [{"url": "https://www.synology.com/en-global/security/advisory/Synology_SA_26_13", "name": "Synology-SA-26:13 DSM"}], "descriptions": [{"lang": "en", "value": "An insufficient entropy vulnerability in login logic in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-331", "description": "Insufficient Entropy"}]}], "providerMetadata": {"orgId": "db201096-a0cc-46c7-9a55-61d9e221bf01", "shortName": "synology", "dateUpdated": "2026-09-18T08:21:27.534Z"}}}, "cveMetadata": {"cveId": "CVE-2026-13639", "state": "PUBLISHED", "dateUpdated": "2026-09-18T19:13:24.287Z", "dateReserved": "2026-06-29T09:59:06.873Z", "assignerOrgId": "db201096-a0cc-46c7-9a55-61d9e221bf01", "datePublished": "2026-09-18T08:21:27.534Z", "assignerShortName": "synology"}, "dataVersion": "5.2"}