What’s Vulnerable › Vulnerabilities

CVE-2016-6554: Synology NAS servers DS107, DS116, and DS213, use default credentials

• Severity: critical (CVSS 9.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 4.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-07-13 · updated 2026-06-17
• Weakness: CWE-255

Description

Synology NAS servers DS107, firmware version 3.1-1639 and prior, and DS116, DS213, firmware versions prior to 5.2-5644-1, use non-random default credentials of: guest:(blank) and admin:(blank) . A remote network attacker can gain privileged access to a vulnerable device.

Affected products

• Synology Ds107 Firmware: through 3.1-1639
• Synology Ds116 Firmware: through 5.2-5644-1
• Synology Ds213 Firmware: through 5.2-5644-1

References

• https://www.kb.cert.org/vuls/id/404187
• https://www.securityfocus.com/bid/93805
• https://www.synology.com/en-global/releaseNote/DS213
• https://www.kb.cert.org/vuls/id/404187
• https://www.securityfocus.com/bid/93805
• https://www.synology.com/en-global/releaseNote/DS213

Get alerted when CVE-2016-6554 or the next vulnerability affects your stack