Threat Intelligence Report — CVE-2026-13673

Executive Summary

CVE-2026-13673 is a high-severity (CVSS 8.8) incorrect permission assignment vulnerability (CWE-732) in the LDAP API of Synology DiskStation Manager (DSM). It allows a remote, authenticated attacker to read or write arbitrary files and to cause denial-of-service conditions on affected NAS appliances. All DSM installations below the referenced build numbers across the 7.2.1, 7.2.2, 7.3.2, and 7.4 release trains are in scope, making this a high-risk finding for storage infrastructure exposed to untrusted networks.

Technical Analysis

The vulnerability resides in the DSM LDAP API. CWE-732 ("Incorrect Permission Assignment for Critical Resource") indicates that the LDAP API component enforces access controls incorrectly — a critical resource (in this case, file system access reachable through the API) is granted permissions broader than intended, or is checked against an insufficient authorization predicate.

Two intertwined weaknesses follow from this:

1. Authorization/access-control failure — the LDAP API does not properly constrain what an authenticated (but low-privilege) user is permitted to do. The CWE classification indicates the flaw is a permission assignment problem, not an injection or memory-safety bug. The API effectively trusts an authenticated session for operations it should reject.
2. Path/scope control failure — because the impact includes "read or write arbitrary files," the API's file-handling does not adequately restrict the target of file operations to an intended directory or resource scope. The permission defect lets an authenticated caller reach files outside the intended boundary.

Taken together, an attacker who has obtained any valid authenticated session (the CVSS vector sets PR:L, i.e., low privileges required) can leverage the LDAP API to bypass intended file-access boundaries, yielding High Confidentiality and High Integrity impact (C:H/I:H). The A:H subscore reflects availability loss, consistent with the described "denial-of-service attacks" — likely achieved by overwriting or corrupting critical files reachable through the same path, or by inducing resource-exhaustion conditions during arbitrary file operations.

The attack is network-reachable (AV:N) with no user interaction required (UI:N) and low complexity (AC:L); no scope change is indicated (S:U), meaning exploitation stays within the DSM security authority. Notably, no CNA title was supplied and the description is function-agnostic — no specific API endpoint, parameter name, or code path is disclosed, so analysis must remain at the vulnerability-class level. This is a permission-logic flaw: exploitation requires only an authenticated foothold plus the ability to invoke the LDAP API's file-related operations within their erroneous authorization context.

The attack surface is any DSM management or LDAP-integrated service that exposes this API to an authenticated principal — typically the DSM web interface (default ports 5000/5001) and any integrated directory-authentication flows. Internet-exposed DSM instances with LDAP configured are the primary exposure.

Exploitation Scenarios

No public PoC is available; the chain below is inferred from the vulnerability class (CWE-732 in an LDAP API) and the stated impact.

1. Reconnaissance / target identification. The attacker enumerates internet- or intranet-exposed Synology DSM management interfaces (e.g., via Shodan/certificate pivots on "Synology DiskStation", ports 5000/5001). They confirm the DSM build is below the threshold builds listed in the advisory, and confirm LDAP integration is enabled (a DSM configured as an LDAP client, or the LDAP API otherwise reachable).

2. Foothold / authentication. Because the vulnerability requires authentication (PR:L), the attacker first obtains a low-privilege authenticated session. This could be a legitimate but low-privileged account, a credential obtained in an unrelated breach, or a shared/guest account. The vulnerability itself does not provide the initial credential — it elevates the capabilities of any authenticated session against the LDAP API.

3. Triggering the flaw class. With a valid session, the attacker invokes the DSM LDAP API's file-related operations. Because the API assigns permissions to a critical resource incorrectly (CWE-732), the authorization check that should restrict these operations to appropriate roles/resources fails to do so. The API consequently honors file read/write requests the caller should not be permitted to make. No specific endpoint or parameter is named in the advisory; the precise call syntax must be determined by the attacker against a live instance.

4. Payload / execution (class-level). The "payload" is not code execution but access to the file system through the mis-permissioned API: the attacker reads arbitrary files (confidentiality breach) and/or writes arbitrary files (integrity breach). Writing files on a NAS can, depending on what is reachable, allow tampering with configuration, stored data, or startup-referenced content — a persistence or data-integrity vector. The DoS impact is produced by the same file operations (e.g., corrupting or overwriting content required for normal operation) or by exhausting resources during arbitrary file handling.

5. Post-exploitation impact. Disclosure of sensitive files stored on or readable by the appliance; modification or destruction of those files; degradation or outage of DSM services (DoS). On a NAS that frequently holds backups and shared documents, the resulting confidentiality and integrity loss can be business-critical.

Impact Assessment

• Confidentiality (High, C:H): Read access to arbitrary files exposes user data, shared folders, configuration, and potentially credential material or secrets stored on the appliance.
• Integrity (High, I:H): Write access to arbitrary files enables tampering, data destruction, and potential persistence — a serious concern on a system that is often a backup target.
• Availability (High, A:H): Explicit denial-of-service capability means an attacker can disrupt storage services, harming business continuity.
• Privileges required (Low, PR:L): Any authenticated session suffices, sharply lowering the bar to exploitation.
• Blast radius: DSM appliances are centralized data hubs — compromise ripples to every user and workflow that depends on the NAS. LDAP-integrated environments may fan out the impact to directory-linked accounts and systems. The score of 8.8 and NO CISA KEV listing means no known active exploitation is confirmed, but the low barrier and high impact make proactive remediation urgent.

Detection Guidance

Detection content below is heuristic and vulnerability-class based. Because the advisory names no endpoint, parameter, or file path, rules focus on anomalous LDAP-API usage, abnormal file operations on DSM, and DoS indicators — not on exact exploit signatures. Tune to your environment.

Sigma Rule

title: Suspicious Synology DSM LDAP API File Access and DoS Activity (CVE-2026-13673)
id: 9f3c1b7e-2a44-4d1a-9c0e-1cve202613673
status: experimental
description: Detects anomalous authenticated LDAP API activity on Synology DSM consistent with CWE-732 permission-abuse leading to arbitrary file read/write and DoS.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-13673
author: valtersit.com
date: 2026/01/01
logsource:
  product: synology
  service: dsm
detection:
  selection_ldap:
    EventID: 2000
    Message|contains:
      - 'ldap'
      - 'LDAP'
      - 'ldapsrv'
  selection_fileops:
    Message|contains:
      - 'forbidden'
      - 'permission'
      - 'outside'
      - 'path traversal'
      - 'unauthorized file'
  selection_auth:
    EventID: 4624
    Account|endswith: '$'
  timeframe: 5m
  condition: selection_ldap and (selection_fileops or selection_auth)
falsepositives:
  - Legitimate LDAP administration by authorized admins
  - Backup or sync jobs touching many files
level: high
tags:
  - attack.t1190
  - cve.2026.13673

YARA Rule

rule CVE_2026_13673_Synology_DSM_LDAP_Abuse_Indicators
{
    meta:
        description = "Heuristic hunt for artifacts/strings associated with CVE-2026-13673 (Synology DSM LDAP API permission abuse -> arbitrary file read/write / DoS)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-13673"
        date = "2026-01-01"
        severity = "high"
        cve = "CVE-2026-13673"

    strings:
        $ldap1 = "ldap" nocase
        $ldap2 = "ldapsrv" nocase
        $dsm1  = "DiskStation" nocase
        $adv1  = "7.2.1-69057" ascii
        $adv2  = "7.2.2-72806" ascii
        $adv3  = "7.3.2-86009" ascii
        $adv4  = "7.4-90075" ascii
        $err1  = "permission denied" ascii nocase
        $err2  = "arbitrary file" ascii nocase

    condition:
        (uint16(0) == 0x5A4D and ($dsm1 or $ldap1 or $ldap2)) or
        (2 of ($adv*) and ($ldap1 or $ldap2)) or
        ($ldap1 and ($err1 or $err2))
}

Suricata IDS Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET [5000,5001] (msg:"CVE-2026-13673 Synology DSM LDAP API abuse - anomalous file read/write attempt"; flow:to_server,established; content:"ldap"; nocase; http_uri; content:"file"; nocase; http_uri; http_header_names; content:"Cookie|3a|"; nocase; http_header; pcre:"/id=[^&]*ldap[^&]*/iU"; threshold:type both, track by_src, count 20, seconds 60; sid:2026136730; rev:1; metadata:cve CVE-2026-13673, created_at 2026-01-01, author valtersit.com; classtype:attempted-user;)

alert tcp $EXTERNAL_NET any -> $HOME_NET [5000,5001] (msg:"CVE-2026-13673 Synology DSM possible DoS via LDAP API file operations"; flow:to_server,established; content:"ldap"; nocase; http_uri; pcre:"/(read|write|upload|download|file|path)/iU"; threshold:type threshold, track by_src, count 50, seconds 60; sid:2026136731; rev:1; metadata:cve CVE-2026-13673, author valtersit.com; classtype:denial-of-service;)

Elastic Detection

sequence by source.ip with maxspan=2m
  [ network where network.direction == "inbound"
      and destination.port in (5000, 5001)
      and url.path : "*ldap*" ]
  [ network where network.direction == "inbound"
      and destination.port in (5000, 5001)
      and url.path : ("*file*" or "*upload*" or "*download*" or "*read*" or "*write*")
      and http.response.status_code in (200, 201, 500, 503) ]

Splunk SPL Query

index=network OR index=web
| eval is_dsm = if((dest_port=5000 OR dest_port=5001), 1, 0)
| where is_dsm=1
| eval ldap_hit = if(match(lower(url), "ldap"), 1, 0)
| eval file_hit = if(match(lower(url), "(file|read|write|upload|download|path)"), 1, 0)
| where ldap_hit=1 AND file_hit=1
| stats count AS attempts, dc(url) AS distinct_paths, values(src_ip) AS sources BY dest_ip
| where attempts >= 10 OR distinct_paths >= 5
| sort - attempts

Wazuh OSSEC Rule

<group name="synology,dsm,cve-2026-13673,">
  <rule id="202613673" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">\.*ldap\.*</field>
    <field name="url">\.*(file|read|write|upload|download|path)\.*</field>
    <description>CVE-2026-13673: Possible Synology DSM LDAP API permission-abuse - suspicious file operation (arbitrary read/write / DoS)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack,</group>
  </rule>

  <rule id="202613674" level="10" frequency="20" timeframe="60">
    <if_matched_sid>202613673</if_matched_sid>
    <same_source_ip />
    <description>CVE-2026-13673: High-frequency LDAP API file operations from single source - possible DoS activity against Synology DSM</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence was returned from any tracked source. No vendor fix or workaround is confirmed in the provided data.

1. Immediate mitigations

   • Do not expose DSM management (ports 5000/5001) or LDAP-integrated services to untrusted networks. Enforce access via VPN/reverse proxy with strong authentication; restrict by source IP with firewall ACLs.
   • Minimize and audit authenticated accounts. Since PR:L is required, reduce the number of low-privileged accounts with any ability to reach the LDAP API; disable unused/guest accounts; rotate credentials and enforce MFA.
   • Disable LDAP integration if it is not operationally required, and restrict which accounts can invoke directory-related functions.
   • Back up critical files and enable integrity monitoring on the NAS so any unauthorized write is detected and reversible.
   • Monitor aggressively using the detection content above, given no reliable exploit signature exists.

2. Patch / upgrade steps

   • Track Synology's security advisory page for this CVE. The NVD description identifies the fixed build thresholds (7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, 7.4-90075) — upgrade to the build at or above the corresponding threshold for your release train once Synology publishes it.
   • As of this writing, no patch evidence exists in tracked sources; verify availability directly with Synology before relying on upgrade as a fix.

3. Long-term hardening

   • Segment NAS devices on a dedicated management VLAN; never place them directly on the internet.
   • Apply the principle of least privilege to all DSM and LDAP-linked accounts; conduct periodic entitlement reviews.
   • Enable centralized logging (syslog to SIEM/Wazuh), file-integrity monitoring, and immutable/offline backups to limit DoS and tamper impact.
   • Maintain an asset inventory of DSM builds and subscribe to Synology and CISA advisories for rapid response.

References

1. NVD — CVE-2026-13673: https://nvd.nist.gov/vuln/detail/CVE-2026-13673
2. Synology Product Security Advisory portal: https://www.synology.com/en-global/security/advisory
3. MITRE CWE-732 — Incorrect Permission Assignment for Critical Resource: https://cwe.mitre.org/data/definitions/732.html
4. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
5. CISA Known Exploited Vulnerabilities Catalog (CVE-2026-13673 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / exploitation note: No public PoC, Nuclei template, or exploit code was identified, and the CVE is not in CISA KEV. There is currently no evidence of exploit-in-the-wild or attributed campaigns. The 8.8 severity and low privilege requirement nonetheless warrant prioritized, preventive remediation.