CVE-2018-8916

MEDIUM

Synology Diskstation Manager < 6.2-23739 - Password Reset Weakness

Title source: rule

Description

Unverified password change vulnerability in Change Password in Synology DiskStation Manager (DSM) before 6.2-23739 allows remote authenticated users to reset password without verification.

References (1)

[Vendor Advisory] https://www.synology.com/en-global/support/security/Synology_SA_18_24

Scores

CVSS v3 6.3

EPSS 0.0028

EPSS Percentile 51.3%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Details

CWE

CWE-620 CWE-640

Status published

Products (1)

synology/diskstation_manager < 6.2-23739

Published Jun 08, 2018

Tracked Since Feb 18, 2026