CVE-2020-27650

3.7 lowEPSS 0.6%

Low (3.7) in synology. EPSS 0.6% chance of exploitation in the next 30 days.

Synology DiskStation Manager (DSM) before 6.2.3-25426-2 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session.

Severity

CVSS 3.1

3.7 low

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 46% of CVEs (scores of 2026-10-31)
CWEs: CWE-311, CWE-614
Published: 2020-10-29
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

synology:diskstation_manager
synology:skynas_firmware

References

https://www.synology.com/security/advisory/Synology_SA_20_18
https://www.synology.com/security/advisory/Synology_SA_20_18

Check your stack JSON