CVE-2026-13684: Synology DSM SCGI DOS Vulnerability

CVE-2026-13684 Overview

CVE-2026-13684 is an improper encoding or escaping of output vulnerability [CWE-116] in the Simple Common Gateway Interface (SCGI) component of Synology DiskStation Manager (DSM). Remote attackers can exploit the flaw over the network without authentication to read or write arbitrary files and trigger denial-of-service conditions on affected devices. The issue affects DSM releases prior to 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075. Synology published fixes in advisory SA-26-13.

Critical Impact
Unauthenticated remote attackers can read or overwrite arbitrary files on a Synology NAS, leading to data theft, integrity loss, and appliance unavailability.

Affected Products

Synology DiskStation Manager (DSM) 7.2.1 before 7.2.1-69057-12
Synology DiskStation Manager (DSM) 7.2.2 before 7.2.2-72806-9
Synology DiskStation Manager (DSM) 7.3.2 before 7.3.2-86009-4 and 7.4 before 7.4-90075

Discovery Timeline

2026-09-18 - CVE-2026-13684 published to the National Vulnerability Database
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-13684

Vulnerability Analysis

The flaw resides in the SCGI interface used by DSM to bridge web front-end requests to back-end services. SCGI transports request metadata as length-prefixed netstrings containing header name and value pairs. When DSM constructs or forwards these headers, it fails to properly encode or escape output before it is consumed by downstream components. An attacker who crafts network requests can influence SCGI header framing and inject fields that back-end handlers interpret as trusted directives.

Because the SCGI endpoint is reachable over the network and requires no authentication or user interaction, an attacker with only network access to the DSM web service can trigger the condition. Successful exploitation yields arbitrary file read, arbitrary file write, and denial of service against the appliance and its hosted services.

Root Cause

The root cause is an output encoding failure classified as [CWE-116]. The SCGI producer does not sanitize characters and delimiters that carry semantic meaning in the SCGI protocol or in downstream request contexts. This mismatch between producer and consumer parsing lets attacker-controlled data cross a trust boundary and alter server-side behavior.

Attack Vector

Exploitation occurs over the network against the DSM management interface. An attacker sends crafted HTTP requests that reach the SCGI gateway. Malformed or attacker-injected header content propagates through SCGI framing, letting the attacker coerce back-end file handlers into reading protected files, writing attacker-supplied content, or crashing services. No verified public proof-of-concept is currently referenced in the advisory.

Refer to the Synology Security Advisory SA-26-13 for vendor-provided technical details.

Detection Methods for CVE-2026-13684

Indicators of Compromise

Unexpected files appearing under DSM system paths such as /etc, /usr/syno, or shared volumes owned by web service accounts.
Web server or SCGI process crashes and restarts recorded in DSM system logs without a corresponding administrative action.
Outbound connections or new administrative accounts created shortly after anomalous requests to the DSM web interface.

Detection Strategies

Inspect DSM web access logs for requests containing unusual header names, embedded control characters, or oversized length prefixes targeting SCGI-backed endpoints.
Alert on repeated 5xx responses or SCGI backend timeouts that correlate with a single source IP address.
Baseline read and write operations against sensitive DSM configuration files and flag deviations performed by web service accounts.

Monitoring Recommendations

Forward DSM logs and network telemetry into a centralized analytics platform such as Singularity Data Lake for correlation with edge and identity signals.
Monitor management interfaces for exposure to untrusted networks and track authentication and administrative changes on Synology appliances.
Track vendor advisories and DSM update status across the fleet to confirm patched versions are deployed.

How to Mitigate CVE-2026-13684

Immediate Actions Required

Upgrade DSM to 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, 7.4-90075, or later as applicable to the installed release branch.
Restrict access to the DSM web interface and SCGI endpoints to trusted management networks using firewall rules and VPN gating.
Audit file shares and system directories for unauthorized modifications performed since the appliance was first exposed to untrusted networks.

Patch Information

Synology addressed CVE-2026-13684 in DSM versions 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075. Administrators should apply the update via DSM Control Panel Update & Restore or download the corresponding patch from Synology. Full details are published in the Synology Security Advisory SA-26-13.

Workarounds

Disable remote access to DSM from the public internet, including QuickConnect and port forwarding, until the appliance is patched.
Enforce IP allowlists and rate limiting on the DSM web portal through the built-in firewall and auto-block features.
Rotate credentials, API tokens, and stored secrets on the appliance after patching if compromise is suspected.

bash

# Example: restrict DSM management ports to a trusted management subnet
# Adjust the interface and subnet to match your environment

iptables -A INPUT -p tcp -m multiport --dports 5000,5001 \
  -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp -m multiport --dports 5000,5001 -j DROP