VendorsInfrastructure
Synology
Synology makes network-attached storage (NAS) devices running DiskStation Manager (DSM), BeeStation, surveillance software and routers running Synology Router Manager.
- Response trend, 6 months
- Not enough history
- Open now
- None
- Latest incident
- none on record
- Incidents on record
- 0
Response to exploited bugs
Not rated. No reviewed zero-days yet.
Fixing privately reported bugs
74 range 60–87rank 14 of 20
Provisional 6 private reports, published on 5 dates. Not enough yet for a firm grade.
What a grade means. B means the vendor met the public norm, such as a first fix within 7 days of the first public report or a private fix within 120 days. Taking half the norm time scores 92, an A. Taking twice the norm time scores 43, a D−. How grades work
Why these grades
Every clock starts at the first public report.
- Response to exploited bugs: not rated. No reviewed exploited zero-days in the last 36 months, so this grade does not apply yet.
- Fixing privately reported bugs: B- (74), provisional. Median 38 days from private report to fix (6 cases, 5 with a vendor fix date). 2 of 6 took longer than ZDI's 120-day deadline. 4 more cases are held back until their dates are checked.
- No exploited incidents on record for the last 36 months.
Response to exploited bugs: sub-scores
- Time to first advisoryNo reviewed zero-days in the last 36 monthsNR0 cases, not used
- Time to first fixNo reviewed zero-days in the last 36 monthsNR0 cases, not used
- Time to fix all versionsNo reviewed zero-days in the last 36 monthsNR0 cases, not used
- OpennessAdvisories available by RSS624 cases, low confidence, not used for this vendor
Fixing privately reported bugs: sub-score
- Private fix speedMedian 38 days from private report to fix (6 cases, 5 with a vendor fix date)74B−6 cases, low confidence, weight 100%
Response fingerprint
No exploited incidents on record in the last 24 months.
Private reports
Median 38 days, 33% over 120 days, 0 published unpatched
Bugs reported privately to Synology by ZDI or Project Zero.
120-day deadlinemedian 38d
| Published | Advisory | Product | Days from report to fix or to publication. Tick: ZDI's 120-day deadline. | Patch at publication |
|---|---|---|---|---|
| 15 Jul 2026 | ZDI-26-423, ZDI-26-424CVE-2025-15660, CVE-2026-13135 | DiskStation DS925+ | 204to vendor fix, 26 Jun 2026 | Yes |
| 16 Mar 2026 | ZDI-26-187CVE-2022-45188Not gradedthe linked vendor advisory https://www.synology.com/en-global/security/advisory/Synology_SA_22_23 is dated 2022-12-08, before the report date 2022-12-29: it describes an earlier fix | DiskStation Manager | 1173to publication | Yes |
| 3 Dec 2025 | ZDI-25-1039CVE-2025-12686Not gradedthe linked vendor advisory https://www.synology.com/en-us/security/advisory/Synology_SA_25_12 is dated 2025-11-10, before the report date 2025-11-20: it describes an earlier fix | BeeStation Plus | 13to publication | Yes |
| 3 Dec 2025 | ZDI-25-1040CVE-2025-13392 | DiskStation DS925+ | 1to vendor fix, 19 Nov 2025 | Yes |
| 1 May 2025 | ZDI-25-207, ZDI-25-208, ZDI-25-209, ZDI-25-210, ZDI-25-211, ZDI-25-212, ZDI-25-213, ZDI-25-214, ZDI-25-216, ZDI-25-269CVE-2024-10441, CVE-2024-10442, CVE-2024-10443, CVE-2024-10445, CVE-2024-11131, CVE-2024-50629, CVE-2024-50630, CVE-2024-50631Not gradedthe linked vendor advisory https://www.synology.com/en-us/security/advisory/Synology_SA_24_18 is dated 2024-10-25, before the report date 2024-12-02: it describes an earlier fix; the linked vendor advisory https://www.synology.com/en-us/security/advisory/Synology_SA_24_22 is dated 2024-11-05, before the report date 2024-12-02: it describes an earlier fix; the linked vendor advisory https://www.synology.com/en-us/security/advisory/Synology_SA_24_20 is dated 2024-11-05, before the report date 2024 | BeeStation BST150-4T; DiskStation DS1823xs+; TC500 | 150to publication | Yes |
| 9 Apr 2025 | ZDI-25-215CVE-2024-10444 | DiskStation DS1823xs+ | 64to vendor fix, 4 Feb 2025 | Yes |
| 11 Jul 2024 | ZDI-24-832CVE-2024-39347 | RT6600ax | 6to vendor fix, 21 Nov 2023 | Yes |
| 11 Jul 2024 | ZDI-24-833, ZDI-24-834, ZDI-24-835CVE-2024-39349, CVE-2024-39350, CVE-2024-39352 | BC500 | 11to vendor fix, 20 Nov 2023 | Yes |
| 21 Jun 2024 | ZDI-24-836Not gradedthe linked vendor advisory https://www.synology.com/en-id/security/advisory/Synology_SA_23_15 is dated 2023-11-20, before the report date 2024-02-21: it describes an earlier fix | BC500 | 121to publication | Yes |
| 15 Jan 2024 | ZDI-24-072CVE-2024-21473 | RT6600ax | 409to publication | Yes |
Grade history
Response to exploited bugs: score at the end of each month.
Not rated at any point in this period.
Channels
Get Synology's own alerts
- RSSSynology product security advisory RSSAdd the advisory feed to a feed reader or chat integration.
- BlueskySynology on BlueskyFollow the account.
- XSynology on XFollow the account and turn on notifications.
- Advisory pageSynology security advisoriesCheck the advisory page. It has no push channel.
What we watch
- RSSSynology product security advisory RSS
See sources and health for when each was last read.
Grade not rated.