CVE-2017-16766: Synology Diskstation Manager

Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days.

An improper access control vulnerability in synodsmnotify in Synology DiskStation Manager (DSM) before 6.1.4-15217 and before 6.0.3-8754-6 allows local users to inject arbitrary web script or HTML via the -fn option.

Affected products

• Synology Diskstation Manager: from 6.0.0, before 6.0.3-8754-6 (fixed in 6.0.3-8754-6); from 6.1.0, before 6.1.4-15217 (fixed in 6.1.4-15217)

Published 2017-12-22. Last modified 2026-06-17.