CVE-2018-13280 Weak cryptography in DiskStation Manager (DSM)

What is CVE-2018-13280?

CVE-2018-13280 is a high-severity vulnerability in Synology Diskstation Manager, published on 30 Jul 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Use of insufficiently random values vulnerability in SYNO.Encryption.GenRandomKey in Synology DiskStation Manager (DSM) before 6.2-23739 allows man-in-the-middle attackers to compromise non-HTTPS sessions via unspecified vectors.

Weakness: CWE-330

Which versions are affected by CVE-2018-13280?

It affects 1 product.

Products include Synology Diskstation Manager.

How do I fix CVE-2018-13280?

No fix has been published for CVE-2018-13280 yet. Limit exposure of the affected software until one is available.

Is CVE-2018-13280 being exploited?

There is no known exploitation of CVE-2018-13280 in the wild and no public exploit code.

Other vulnerabilities in Synology Diskstation Manager

• CVE-2022-27624 Memory corruption in DiskStation Manager (DSM) Critical 10.0
• CVE-2022-27625 Memory corruption in DiskStation Manager (DSM) Critical 10.0
• CVE-2022-27626 Race condition in DiskStation Manager (DSM) Critical 10.0
• CVE-2013-6955 Path traversal in n/a Critical 10.0
• CVE-2022-22687 Memory corruption in DiskStation Manager (DSM) Critical 9.8

All Synology Diskstation Manager vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-fq7w-prpm-xwrj.