CVE-2026-13635

Executive Summary

CVE-2026-13635 is an improper output encoding/escaping vulnerability (CWE-116) in the Auth API of Synology DiskStation Manager (DSM). It is remotely exploitable without authentication and without user interaction, but its impact is limited to the disclosure of non-sensitive information (CVSS 5.3, Confidentiality: Low). All DSM installations below the fixed builds listed for the 7.2.1, 7.2.2, 7.3.2, and 7.4 branches are affected. No public proof-of-concept, exploit code, or CISA KEV listing is associated with this CVE as of this report.

Technical Analysis

The vulnerability resides in the Auth API of Synology DSM, which is the component that handles authentication-related requests for DSM's web-based management interface and its associated WebAPI surface. Per the NVD description, the defect is classified as improper encoding or escaping of output — CWE-116. This class of weakness occurs when an application places untrusted or internally derived data into an output context (HTML, JavaScript, JSON, HTTP headers, or similar) without applying context-appropriate encoding, allowing the structure of that output to be altered by the data itself.

Several precise facts can be established from the provided data, and importantly, several cannot:

• Attack vector: Network (AV:N), no privileges required (PR:N), no user interaction (UI:N). The Auth API is reachable remotely, consistent with DSM's public-facing login/authentication endpoints.
• Impact scope: Integrity and Availability are unaffected (I:N/A:N); only Confidentiality is impacted, and only at a Low level (C:L). This is consistent with the NVD wording that attackers can "obtain non-sensitive information" — i.e., no credential material, session tokens, or other secret data are disclosed per the vendor's own characterization.
• Weakness class: Output encoding/escaping failure, not an injection that leads to code execution, privilege escalation, or authentication bypass.

Zusätzlich: The specific output context (HTML, JavaScript, JSON response body, or HTTP response header) in which the improper escaping occurs is not disclosed in the NVD description, and the CNA title field is empty. No function names, endpoint paths (beyond the generic "Auth API" reference), or parameter names are provided. This report therefore confines itself to class-level analysis and does not fabricate implementation detail.

An output-encoding flaw in an authentication API is significant primarily because authentication endpoints are unauthenticated by definition — any remote party can reach them — and because their responses are frequently processed by client-side code (browsers, mobile apps, automation scripts) and sometimes by intermediary components such as reverse proxies and log collectors. Depending on the exact context, CWE-116 variants can manifest as reflected content manipulation (client-side script execution in the worst case), response splitting if the flaw is in header encoding, or log/telemetry injection if the unencoded output is persisted downstream. Because the CVSS confidentiality-only scoring and the "non-sensitive information" wording point away from credential disclosure, the most plausible class-level mechanism is information leakage through a response that is not properly constrained — for example, echoing back request-derived content or internal state in a form that a remote attacker can shape or observe.

It is essential to state clearly: no public proof-of-concept, Nuclei template, or exploit code exists for this CVE, and no evidence of in-the-wild exploitation or threat-actor campaign has been provided. Inferred attack chains below are constructed from the vulnerability class and the CVSS profile, not from observed exploits.

Exploitation Scenarios

Because no public exploit or detailed advisory is available, the following chain is described at the vulnerability-class level, strictly bounded by the NVD description. No specific endpoints, parameters, or payload strings are asserted.

1. Reconnaissance / target identification. An attacker scans for internet-exposed Synology DSM management interfaces (commonly on TCP 5000/5001 and via reverse-proxied hostnames). Shodan dorks such as product:"Synology DiskStation Manager" or http.title:"Synology DiskStation" enumerate candidate systems. The attacker fingerprints the DSM version from the login page or response headers to determine whether the build predates the fixed versions (7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, 7.4-90075).

2. Triggering the flaw class. The attacker sends a crafted request to the DSM Auth API, shaping input that the API subsequently reflects or emits without proper output encoding/escaping. Because the vulnerability requires no credentials (PR:N) and no victim interaction (UI:N), a single request to the authentication surface is sufficient to reach the vulnerable code path. The attacker iterates on request content to observe how the improperly encoded output changes.

3. Payload/execution method (class level). In CWE-116 cases, the "payload" is not an exploit shellcode but data crafted to alter or reveal the structure of the API's output. Depending on the actual output context (HTML, JS, JSON, or headers — unspecified in the available data), the attacker may aim to (a) cause the response to expose non-sensitive information it should not reveal, or (b) manipulate the response such that a downstream consumer (browser, proxy, or log pipeline) interprets it differently than intended. No public weaponized payload exists; attack development is entirely speculative at this time.

4. Post-exploitation impact. Per the CVSS vector, the attacker gains at most Low-confidentiality impact: retrieval of non-sensitive information. There is no integrity impact (no data modification), no availability impact (no denial of service), and no scope change (no pivot to other components). In practice this makes CVE-2026-13635 a reconnaissance-grade finding — useful for fingerprinting, banner gathering, or confirming target identity prior to chaining with higher-severity vulnerabilities — rather than a standalone compromise vector.

Note: If a future analysis determines the unencoded output context is an active client-side execution context, impact could differ from the vendor's "non-sensitive information" framing. Until vendor or researcher detail is published, treat the CVSS 5.3 assessment as authoritative.

Impact Assessment

CVSS 3.1: 5.3 (Medium) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

• Attack Vector: Network — remotely reachable; DSM units exposed to the internet via port forwarding, reverse proxy, or QuickConnect are directly at risk. LAN-only deployments still face an insider/adjacent-network attack surface.
• Attack Complexity: Low — no specialized conditions or race windows implied; the flaw is deterministic once the correct request shape is identified.
• Privileges Required: None / User Interaction: None — the Auth API is pre-authentication, so any remote client can attempt exploitation.
• Confidentiality: Low — only non-sensitive information is exposed. The vendor explicitly scopes the disclosure away from secrets.
• Integrity / Availability: None; Scope: Unchanged — no persistence, no data tampering, no DoS, no cross-component impact.

Business impact. For most organizations the direct business impact is low. The realistic risk is aggregate and chained: a low-severity information disclosure in a NAS authentication API can serve as an oracle or fingerprinting aid that improves the reliability of follow-on attacks against the same internet-exposed device. NAS appliances frequently hold regulated data, backups, and identity-adjacent configuration (LDAP/AD integration), so any unauthenticated disclosure on this surface warrants attention disproportionate to its CVSS score.

Blast radius. All Synology DSM systems on the affected branches (< 7.2.1-69057-12, < 7.2.2-72806-9, < 7.3.2-86009-4, < 7.4-90075). DSM powers DiskStation, RackStation, FlashStation, and embedded NAS lines, so installations can span departments, SMBs, and homelab environments. Given the popularity of DSM and the historical targeting of exposed NAS devices, a large number of instances are potentially in scope until patched.

Detection Guidance

Detection is challenging because no public exploit traffic signature exists. Rules below target the class of activity: anomalous, unauthenticated interaction with DSM authentication endpoints on versions predating the fixed builds. Network rules should be tuned to reduce false positives, as legitimate login traffic shares the same endpoints.

Sigma Rule

title: Unauthenticated Anomalous Requests to Synology DSM Auth API (CVE-2026-13635)
id: 8f3c1a2e-5b74-4d9a-9e21-7c0f4a6b2d10
status: experimental
description: Detects atypical unauthenticated request patterns to the DSM Auth API that may indicate probing of CWE-116 output-encoding behavior in CVE-2026-13635.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-13635
author: valtersit.com Threat Intelligence
date: 2026/01/01
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
  product: synology
detection:
  selection_path:
    cs-uri-stem|contains:
      - '/webapi/auth.cgi'
      - '/webapi/entry.cgi'
  selection_method:
    cs-method: 'GET'
  selection_suspicious:
    cs-uri-query|contains:
      - 'api=SYNO.API.Auth'
      - 'method='
  filter_normal:
    sc-status: 200
  condition: selection_path and selection_method and selection_suspicious
fields:
  - c-ip
  - cs-uri-query
  - sc-status
  - cs-user-agent
falsepositives:
  - Legitimate unauthenticated requests from mobile clients and DSM mobile apps
  - Health-check or monitoring probes hitting the login API
level: low

Tuning note: the Auth API paths above reflect DSM's documented WebAPI surface; validate against your DSM access logs and restrict by request rate, missing session cookie, or abnormal User-Agent before promoting to medium.

YARA Rule

rule CVE_2026_13635_DSM_AuthAPI_Output_Encoding_Probe
{
    meta:
        description = "Detects request artifacts referencing unencoded output probing against Synology DSM Auth API (CVE-2026-13635). Class-level heuristic only; no public exploit exists."
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-13635"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $a = "SYNO.API.Auth" ascii nocase
        $b1 = "webapi/auth.cgi" ascii nocase
        $b2 = "webapi/entry.cgi" ascii nocase
        $c1 = "<script" ascii nocase
        $c2 = "%3Cscript" ascii nocase
        $c3 = "%3c%73%63%72%69%70%74" ascii nocase

    condition:
        (uint32(0) == 0x20544547 or uint32(0) == 0x54534f50) and
        ($a and ($b1 or $b2)) and any of ($c*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-13635 - Possible Synology DSM Auth API Output-Encoding Probe"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"webapi/auth.cgi"; http.uri; content:"SYNO.API.Auth"; http.header; content:"|0D 0A|"; pcre:"/(?:%3C|<)script/i"; threshold: type both, track by_src, count 5, seconds 60; classtype:attempted-recon; reference:cve,2026-13635; sid:202613635; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=60s
  [ network where network.protocol == "http" and
      url.path : ("*webapi/auth.cgi*", "*webapi/entry.cgi*") and
      url.query contains "SYNO.API.Auth" and http.request.method == "GET" ]
  [ network where network.protocol == "http" and
      url.path : ("*webapi/auth.cgi*", "*webapi/entry.cgi*") and
      url.query regex~ "(%3[Cc]|<)[Ss]cript" ]

Interpretation: a single client hitting the DSM Auth API and then sending an encoded/script-like sequence to the same endpoint within 60 seconds is a candidate CVE-2026-13635 probing pattern.

Splunk SPL Query

index=webserver (sourcetype=access_combined OR sourcetype=nginx:access OR sourcetype=apache:access)
| eval path=lower(uri_path), q=lower(uri_query)
| where (like(path, "%webapi/auth.cgi%") OR like(path, "%webapi/entry.cgi%"))
| eval suspicious=if(match(q, "(%3c|<)script|syno\.api\.auth"), "probe", "normal")
| where suspicious="probe" AND isnull(cookie)
| bin _time span=1m
| stats count dc(clientip) AS unique_ips values(uri_query) AS queries BY _time, clientip, path
| where count >= 5
| sort - count

Wazuh OSSEC Rule

<group name="web,synology,cve-2026-13635,">
  <rule id="100635" level="6">
    <if_sid>31100</if_sid>
    <id>^/webapi/auth.cgi|^/webapi/entry.cgi</id>
    <match>SYNO.API.Auth</match>
    <description>CVE-2026-13635: Possible unauthenticated probe of Synology DSM Auth API (CWE-116 output encoding)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack_initial_access,</group>
  </rule>
  <rule id="100636" level="8" frequency="5" timeframe="60">
    <if_matched_sid>100635</if_matched_sid>
    <same_source_ip />
    <description>CVE-2026-13635: Repeated DSM Auth API probing from same source (possible exploitation attempt)</description>
    <group>attack_initial_access,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED (no patch evidence from any tracked source).

Treat all mitigations below as compensating controls until a verified vendor patch is obtained and independently validated.

1. Immediate mitigations

   • Remove DSM from direct internet exposure. Place DSM behind a VPN or zero-trust access gateway. This alone neutralizes the remote (AV:N) attack path for the vast majority of deployments.
   • Restrict the Auth API surface. Use firewall rules to limit TCP 5000/5001 (and any reverse-proxied hostnames) to trusted management networks only.
   • Enforce MFA and disable default/administrator accounts on the DSM login surface to harden the same component against chained attacks.
   • Enable verbose access logging on DSM and forward logs to the SIEM so the detection rules above can fire.

2. Patch/upgrade steps

   • Per the NVD description, fixed builds are 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075. Because Patch Confidence is 0/4, independently verify these versions against Synology's official DSM release notes and security advisories before relying on them as the remediation target.
   • Upgrade to the fixed build on the branch your device supports (or higher, if a newer update supersedes it).
   • Maintain a version inventory of all DSM instances, including RackStation and embedded NAS models, since update eligibility varies by hardware generation.

3. Long-term hardening

   • Adopt a patch orchestration process for appliances (NAS, VPN, firewall) with a defined SLA for internet-exposed management planes.
   • Monitor Synology's Security Advisory portal and subscribe to CVE feeds for Synology DSM; add DSM endpoints to continuous external attack-surface monitoring with the Shodan dorks in METADATA.
   • Segment NAS storage away from identity infrastructure; do not join DSM to AD/LDAP unless operationally required, and restrict which accounts can authenticate to the management plane.
   • Continuously baseline Auth API traffic so that novel probes of the class detected above stand out against normal login behavior.

References

1. NVD — CVE-2026-13635: https://nvd.nist.gov/vuln/detail/CVE-2026-13635
2. MITRE CWE-116 — Improper Encoding or Escaping of Output: https://cwe.mitre.org/data/definitions/116.html
3. Synology Security Advisory portal (verify fixed versions 7.2.1-69057-12 / 7.2.2-72806-9 / 7.3.2-86009-4 / 7.4-90075 against vendor release notes): https://www.synology.com/en-global/security/advisory
4. FIRST EPSS: Not yet scored for this CVE — check https://api.first.org/data/v1/epss?cve=CVE-2026-13635 for updates (no value available as of this report).
5. CISA Known Exploited Vulnerabilities Catalog: Not listed — CVE-2026-13635 was NOT present in the KEV catalog at time of writing: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat-actor / in-the-wild note: No public exploit code, no Nuclei template, no PoC repository, and no threat-actor campaign has been associated with CVE-2026-13635 in the available data. Historical context: internet-exposed Synology NAS devices have been targeted by ransomware and botnet operators for years, so operators of unpatched DSM instances should assume opportunistic scanning will occur even absent a dedicated exploit. This report will require revision if a public PoC or KEV listing emerges.