Synology's Title Footprint Is Far Larger Than Its DSM App Fingerprint

Synology NAS systems appear in many kinds of web content. Some expose a DSM login, some host unrelated sites and some mention the vendor in a product page. A count-only test around the DSM Auth API SQL injection shows why that distinction matters.

ZoomEye queries used sub_type=all, page 1 and page size 1 on 2026-11-13 between 08:49 and 08:50 Asia/Shanghai.

These are not estimates of vulnerable devices. The app query tests one fingerprint value. The title query finds a much broader textual population that may include default pages, custom portals, documentation and search noise.

CVE-2026-76954 is owner-side work

Synology SA-26:19 describes CVE-2026-76954 as an unauthenticated SQL injection in the DSM Auth API. The vendor says it can lead to arbitrary file read or write and denial of service. Fixed builds are listed for DSM 7.2.1, 7.2.2, 7.3.2 and 7.4.1.

An external banner cannot establish whether a particular NAS is on an affected build. It also cannot show whether the device stores business backups, credentials or shared files. Those facts come from the owner's configuration and asset record.

The app count is useful because it identifies a narrower known fingerprint. The title count is useful for outreach and discovery, but it should not be used as the denominator in a vulnerability report.

Build a NAS ownership map

Search the asset inventory for Synology models, DSM management addresses, QuickConnect paths and backup roles. Include devices used by remote offices, home workers and managed service providers.

Record the full DSM build string, internet reachability, administrative network path, backup targets and the data owners who depend on the appliance. Check the uptime and update history because a device may have been offline during previous patch windows.

Use the ZoomEye candidates to find systems that are not in the internal inventory. Confirm ownership before contacting or scanning them.

Validate the query layers

If a candidate returns a DSM login, inspect the product page and certificate metadata without attempting authentication. Preserve the observed URL, time and query. Do not send exploit payloads to unknown systems.

Inside the organization, verify the fixed build from the DSM update interface or configuration record. A title match can point to the appliance, but only the owner can confirm the build.

After the patch

Restrict DSM management to trusted networks and remove unnecessary forwarding. Review authentication logs for unexpected requests before the update. A large title count does not indicate compromise, and a successful login page load does not prove that the Auth API is vulnerable.

The measurement's value is in the contrast. Exact application data is sparse, while title data is broad and noisy. Security teams should use the first for candidate specificity and the second for discovery, then resolve both against the actual NAS fleet.

References

• Synology Security Advisory SA-26:19
• ZoomEye AI