Critical · published December 4, 2025
🚨 A sneaky CSRF vulnerability in Synology's WebAPI Framework could let attackers execute arbitrary code remotely—without even breaking a sweat! 🔥 Think of it like a delivery person dropping off a package at your door without asking for ID—anyone could send you a malicious gift that opens the door to your home! If exploited, an attacker could take complete control of your Synology device, leading to data theft, unauthorized access, or even the installation of malicious software. This is absolutely devastating for anyone who relies on Synology for secure data management!
Think of it like a delivery person dropping off a package at your door without asking for ID—anyone could send you a malicious gift that opens the door to your home! This vulnerability allows attackers to send unauthorized requests to the WebAPI, letting them execute any code they like. The flaw exists in versions of Synology DiskStation Manager (DSM) before 7.2.1-69057-2 and 7.2.2-72806, and in Synology Unified Controller (DSMUC) before 3.1.4-23079.
If exploited, an attacker could take complete control of your Synology device, leading to data theft, unauthorized access, or even the installation of malicious software. This is absolutely devastating for anyone who relies on Synology for secure data management! Patch your Synology devices immediately to the latest versions: 7.2.1-69057-2 or 7.2.2-72806 for DSM, and 3.1.4-23079 for DSMUC. Additionally, review your security settings to ensure CSRF protections are in place! You've got this! Follow these steps to secure your devices and keep the bad guys at bay! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| synology/diskstation_manager | ≥ 7.2.1-69057, < 7.2.1-69057-2 | 7.2.1-69057-2 |
| synology/diskstation_manager | ≥ 7.2.2-72803, < 7.2.2-72806 | 7.2.2-72806 |
| synology/diskstation_manager_unified_controller | ≥ 3.1-23028, < 3.1.4-23079 | 3.1.4-23079 |