CVE-2018-8916

MEDIUM

Synology DiskStation Manager < 6.2-23739 - Authenticated Unverified Password Change

Title source: llm

Description

Unverified password change vulnerability in Change Password in Synology DiskStation Manager (DSM) before 6.2-23739 allows remote authenticated users to reset password without verification.

References (1)

Core 1

Core References

Vendor Advisory x_refsource_confirm

https://www.synology.com/en-global/support/security/Synology_SA_18_24

Scores

CVSS v3 6.3

EPSS 0.0098

EPSS Percentile 57.4%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Details

CWE

CWE-620 CWE-640

Status published

Products (1)

synology/diskstation_manager < 6.2-23739

Published Jun 08, 2018

Tracked Since Feb 18, 2026