CVE-2021-26566

PoC —

CVSS 3.1

9.0 critical

EPSS

1%p73

Published

Feb 26, 2021 (Feb 26, 2021)

Modified

Jun 17, 2026

Description

Insertion of sensitive information into sent data vulnerability in synorelayd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-the-middle attackers to execute arbitrary commands via inbound QuickConnect traffic.

Vendors: synology
Products: diskstation manager, vs960hd firmware, skynas firmware, diskstation manager unified controller
Weakness: CWE-201, CWE-200
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (1.5%)

In the news1 stories

Vulnerability Spotlight: Multiple vulnerabilities in Synology DiskStation Manager

Cisco TalosApr 20, 13:00 UTC · Apr 20, 2021Vulnerability in the wildCVE-2021-26564 CVE-2021-26565 CVE-2021-26566+4 CVEs