CVE-2018-8919 Information exposure vulnerability in SYNO.Core.Desktop.SessionData in Synology DiskStation Manager (DSM) before 6.1.6-15266 allows remote attackers to steal credentials via unspecified vectors.

CriticalCVSS 9.8 EPSS 1.4%

Published: 2018-12-24 17:00
Updated: 2026-06-17 05:05
Exploit status: No public exploit known

Description

Information exposure vulnerability in SYNO.Core.Desktop.SessionData in Synology DiskStation Manager (DSM) before 6.1.6-15266 allows remote attackers to steal credentials via unspecified vectors.

Affected products

Product	Affected versions	Fixed in
Synology diskstation manager	< 6.1.6-15266	6.1.6-15266
Synology DiskStation Manager (DSM)	< 6.1.6-15266	6.1.6-15266

References

www.synology.com vendor-advisory

CVSS v3.0

9.8 Critical

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

All scores (4)

v3.0 9.8 · nvd@nist.gov
v3.0 8.3 · synology
v3.0 8.3 · security@synology.com
v2.0 5.0 · nvd@nist.gov

Weakness & likelihood

EPSS (exploitation probability, 30 days): 1.44% (percentile 73.6)
CWE: CWE-200 Information Exposure (CWE-200)

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.