A NAS login whose secret can be guessed like a four-digit PIN
CVE-2026-13639 is an entropy failure in Synology DiskStation Manager login logic before the fixed builds 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075. A remote attacker who can reach the DSM web interface can predict or brute-force the weak login token, then use the resulting session to read or write arbitrary files and force a denial-of-service.
Synology's CRITICAL/9.8 rating reflects the direct technical impact of unauthenticated remote file read/write, which is fair for an exposed unit. In practice we downgrade to HIGH: CISA KEV does not list this CVE, EPSS is only 0.00691 (0.69% next-30-day probability), no public PoC is known, and many DSM installations are behind NAT or use QuickConnect only for selective services. However, enterprise Synology units often hold backups or shared data, so exploitation on a high-value backup target would be severe.
4 steps from start to impact.
Reach the DSM login portal
- Target runs an unpatched DSM build
- DSM web portal reachable over internet or internal network
- Many units are behind NAT or use QuickConnect relay without a public port
- Shodan/GreyNoise detection may alert on mass scanning, but targeted scans are easy
Predict or brute-force the weak login token
- Attacker can send repeated requests to the login endpoint
- No rate-limiting or account lockout on token attempts
- No public exploit code or detailed token-generation analysis yet
- WAF may flag high-volume token guessing, but a single predicted token may evade volume detection
Use admin-level session to read or write files
- Session token is accepted and not expired
- Attacker's token maps to an admin or file-privileged account
- If low-privileged user token is predicted, impact is limited; but C:H/I:H suggests admin-level outcome
- Some DSM hardening may restrict write paths, but default installs are vulnerable
Exfiltrate, tamper, or destroy data and backups
- Write access to system or backup directories
- No immutable backup or WORM storage protects the data
- Immutable snapshots or off-unit backup copies can limit permanent loss
- Attacker must locate valuable shares, but DSM structure is well-known
- QuickConnect relay does not mitigate; it simply proxies the vulnerable login endpoint.
- EDR on workstations won't help; DSM runs on the NAS and may not have an endpoint agent.
- WAF rate limiting alone is unreliable; insufficient entropy may allow a single predicted token rather than a high-volume brute force.
The supporting signals.
| CVE ID | CVE-2026-13639 |
|---|---|
| Vendor severity / CVSS | CRITICAL 9.8 — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CWE | CWE-331 Insufficient Entropy |
| Affected versions | DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, 7.4-90075 |
| Fixed versions | 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, 7.4-90075 |
| KEV status | Not listed in CISA KEV as of assessment |
| In-the-wild status | No known active exploitation or named campaigns |
| PoC availability | No public PoC known as of assessment; check pocindex.io and GitHub |
| EPSS score | 0.00691 (0.69% probability next 30 days; low) |
| Exposure / scanning | Shodan/Censys historically show tens of thousands of DSM portals; prompt does not provide live GreyNoise data |
Sources.
Why this verdict
- Remote unauthenticated impact: Exploitation requires no credentials or user interaction and leads to arbitrary file read/write plus DoS on a NAS/backup device.
- Role multiplier: Synology DSM is commonly used as SMB/enterprise file and backup storage; a compromised backup target can mean mass data egress or backup destruction, so the floor is HIGH.
- Friction audit: no KEV, EPSS 0.00691, no public PoC, and many units are not directly internet-exposed; these pull it below CRITICAL.
Why not higher?
Vendor CRITICAL/9.8 assumes all internet-facing DSM units are reachable and exploitable. But EPSS is 0.00691 and CISA KEV does not list the CVE, with no public PoC or active exploitation. QuickConnect and NAT reduce the directly reachable population for many deployments.
Why not lower?
If exploited on an exposed unit, the technical impact is severe: an unauth attacker can read/write arbitrary files on what is often a primary backup or file store. The installed base and high-value role share prevent a MEDIUM or LOW verdict.
Crowdsourced verification payload.
Run this on the Synology NAS itself via SSH as an admin or a user with read access to /etc.defaults/VERSION. Example: bash /tmp/check_dsm_cve.sh. No special privileges beyond file read.
#!/bin/bash
# Check Synology DSM version against CVE-2026-13639 fixed versions
set -u
VERSION_FILE="/etc.defaults/VERSION"
if [ ! -f "$VERSION_FILE" ]; then
echo "UNKNOWN: $VERSION_FILE not found"
exit 3
fi
prod=$(sed -n 's/^productversion="\([^"]*\)".*/\1/p' "$VERSION_FILE")
build=$(sed -n 's/^buildnumber="\([^"]*\)".*/\1/p' "$VERSION_FILE")
if [ -z "$prod" ] || [ -z "$build" ]; then
echo "UNKNOWN: could not parse version"
exit 3
fi
case "$prod" in
7.2.1) fixed_build="69057-12";;
7.2.2) fixed_build="72806-9";;
7.3.2) fixed_build="86009-4";;
7.4) fixed_build="90075";;
*) echo "UNKNOWN: unsupported DSM branch ${prod}"; exit 3;;
esac
full="${prod}-${build}"
if [ "$build" = "$fixed_build" ]; then
echo "PATCHED: ${full}"
exit 0
fi
lower=$(printf '%s\n%s\n' "$fixed_build" "$build" | sort -V | head -1)
if [ "$lower" = "$fixed_build" ]; then
echo "PATCHED: ${full} >= ${prod}-${fixed_build}"
exit 0
else
echo "VULNERABLE: ${full} < ${prod}-${fixed_build}"
exit 2
fi