Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.3
CVE-2020-27652: Algorithm downgrade vulnerability in QuickConnect in Synology DiskStation Manager (DSM) before 6.2.3-25426-2 allows man-in-the-middle attackers to spoof servers and obtain sensitive information via...
CVE-2020-27652 · published 6 years ago
Summary
Algorithm downgrade vulnerability in QuickConnect in Synology DiskStation Manager (DSM) before 6.2.3-25426-2 allows man-in-the-middle attackers to spoof servers and obtain sensitive information via unspecified vectors.
What to do
- Update synology diskstation_manager to version 6.2.3-25426-2 or later.
- Update synology skynas_firmware to version 6.2.3-25426 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| synology | diskstation_manager |
>= 6.2, < 6.2.3-25426-2 cpe:2.3:o:synology:diskstation_manager:*:*:*:*:*:*:*:* |
| synology | skynas_firmware |
< 6.2.3-25426 cpe:2.3:o:synology:skynas_firmware:*:*:*:*:*:*:*:* |
Original advisory text
Algorithm downgrade vulnerability in QuickConnect in Synology DiskStation Manager (DSM) before 6.2.3-25426-2 allows man-in-the-middle attackers to spoof servers and obtain sensitive information via...
Algorithm downgrade vulnerability in QuickConnect in Synology DiskStation Manager (DSM) before 6.2.3-25426-2 allows man-in-the-middle attackers to spoof servers and obtain sensitive information via unspecified vectors.
References
- https://www.synology.com/security/advisory/Synology_SA_20_18 Vendor Advisory
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1061 Exploit Third Party Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Type
CWE-327Use of a Broken Cryptographic Algorithm
Timeline
Published29 Oct 2020
Updated31 Oct 2026
First seen29 Sep 2026
Sources
CVE-2020-27652 · NVD
Track software like this
Free during beta