CVE-2018-8916: Synology Diskstation Manager

High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days.

Unverified password change vulnerability in Change Password in Synology DiskStation Manager (DSM) before 6.2-23739 allows remote authenticated users to reset password without verification.

Affected products

• Synology Diskstation Manager: before 6.2-23739 (fixed in 6.2-23739)

Published 2018-06-08. Last modified 2026-06-17.