CVE-2016-6554: Synology DS107 Firmware

Critical severity, CVSS 9.8. EPSS: 4.1% chance of exploitation in the next 30 days.

Synology NAS servers DS107, firmware version 3.1-1639 and prior, and DS116, DS213, firmware versions prior to 5.2-5644-1, use non-random default credentials of: guest:(blank) and admin:(blank) . A remote network attacker can gain privileged access to a vulnerable device.

Affected products

• Synology DS107 Firmware: up to and including 3.1-1639
• Synology DS116 Firmware: up to and including 5.2-5644-1
• Synology DS213 Firmware: up to and including 5.2-5644-1

Published 2018-07-13. Last modified 2026-06-17.