CVE-2021-34809: Synology Download Station

High severity, CVSS 8.8. EPSS: 1.9% chance of exploitation in the next 30 days.

Improper neutralization of special elements used in a command ('Command Injection') vulnerability in task management component in Synology Download Station before 3.8.16-3566 allows remote authenticated users to execute arbitrary code via unspecified vectors.

Affected products

• Synology Download Station: before 3.8.16-3566 (fixed in 3.8.16-3566)

Published 2021-06-18. Last modified 2026-06-17.