RM
Product
Router Manager
58
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 7High 21Medium 29Low 1
Watch
Add Router Manager to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-27655 | 10.0 | Oct 29 | Improper access control vulnerability in Synology Router Manager (SRM) before 1.2.4-8081 allows remote attackers to access restricted resources via inbound QuickConnect traffic Affected: 1.2 before 1.2.4-8081 |
| CVE-2023-32956 | 9.8 | May 16 | Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in CGI component in Synology Router Manager (SRM) before 1.2.5-8227-6 and… Affected: 1.2 before 1.2.5-8227-6; 1.3 before 1.3.1-9346-3 |
| CVE-2023-0077 | 9.8 | Jan 5 | Integer overflow or wraparound vulnerability in CGI component in Synology Router Manager (SRM) before 1.2.5-8227-6 and 1.3.1-9346-3 allows remote attackers to overflow buffers via… Affected: 1.2 before 1.2.5-8227-6; 1.3 before 1.3.1-9346-3 |
| CVE-2020-27654 | 9.8 | Oct 29 | Improper access control vulnerability in lbd in Synology Router Manager (SRM) before 1.2.4-8081 allows remote attackers to execute arbitrary commands via port (1) 7786/tcp or (2)… Affected: before 1.2.4-8081 |
| CVE-2018-1160 | 9.8 | Dec 20 | Netatalk before 3.1.12 is vulnerable to an out of bounds write in dsi_opensess.c Affected: 1.2 before 1.2-7742-5 |
| CVE-2017-14491 | 9.8 | Oct 4 | Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response Affected: 1.1 |
| CVE-2020-27649 | 9.0 | Oct 29 | Improper certificate validation vulnerability in OpenVPN client in Synology Router Manager (SRM) before 1.2.4-8081 allows man-in-the-middle attackers to spoof servers and obtain… Affected: 1.2 before 1.2.4-8081 |
| CVE-2023-41738 | 8.8 | Aug 31 | Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in Directory Domain Functionality in Synology Router Manager (SRM) before… Affected: before 1.3.1-9346-6 |
| CVE-2019-9502 | 8.8 | Feb 3 | The Broadcom wl WiFi driver is vulnerable to a heap buffer overflow Affected: 1.2 |
| CVE-2019-9501 | 8.8 | Feb 3 | The Broadcom wl WiFi driver is vulnerable to a heap buffer overflow Affected: 1.2 |
| CVE-2018-13285 | 8.8 | Apr 1 | Command injection vulnerability in ftpd in Synology Router Manager (SRM) before 1.1.7-6941-1 allows remote authenticated users to execute arbitrary OS commands via the (1) MKD or… Affected: 1.1 before 1.1.7-6941-1 |
| CVE-2020-27653 | 8.3 | Oct 29 | Algorithm downgrade vulnerability in QuickConnect in Synology Router Manager (SRM) before 1.2.4-8081 allows man-in-the-middle attackers to spoof servers and obtain sensitive… Affected: 1.2 before 1.2.4-8081 |
| CVE-2024-11398 | 8.1 | Dec 4 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in OTP reset functionality in Synology Router Manager (SRM) before 1.3.1-9346-9 allows… Affected: 1.3 before 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; +4 more |
| CVE-2023-0142 | 8.1 | Jun 13 | Uncontrolled search path element vulnerability in Backup Management functionality in Synology DiskStation Manager (DSM) before 6.2.4-25556-8, 7.0.1-42218-7 and 7.1-42661 allows… Affected: 1.2 before 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; +1 more |
| CVE-2023-32955 | 8.1 | May 16 | Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in DHCP Client Functionality in Synology Router Manager (SRM) before… Affected: 1.2 before 1.2.5-8227-6; 1.3 before 1.3.1-9346-3 |
| CVE-2020-27651 | 8.1 | Oct 29 | Synology Router Manager (SRM) before 1.2.4-8081 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this… Affected: 1.2 before 1.2.4-8081 |
| CVE-2019-9499 | 8.1 | Apr 17 | The implementations of EAP-PWD in wpa_supplicant EAP Peer, when built against a crypto library missing explicit validation on imported elements, do not validate the scalar and… Affected: 1.2 |
| CVE-2019-9498 | 8.1 | Apr 17 | The implementations of EAP-PWD in hostapd EAP Server, when built against a crypto library missing explicit validation on imported elements, do not validate the scalar and element… Affected: 1.2 |
| CVE-2024-39348 | 7.5 | Jun 28 | Download of code without integrity check vulnerability in AirPrint functionality in Synology Router Manager (SRM) before 1.2.5-8227-11 and 1.3.1-9346-8 allows man-in-the-middle… Affected: 1.2 before 1.2.5-8227; 1.3 before 1.3.1-9346; 1.2.5-8227; 1.2.5-8227; 1.2.5-8227; 1.2.5-8227; +15 more |
| CVE-2023-41741 | 7.5 | Aug 31 | Exposure of sensitive information to an unauthorized actor vulnerability in cgi component in Synology Router Manager (SRM) before 1.3.1-9346-6 allows remote attackers to obtain… Affected: before 1.3.1-9346-6 |
| CVE-2023-2729 | 7.5 | Jun 13 | Use of insufficiently random values vulnerability in User Management Functionality in Synology DiskStation Manager (DSM) before 7.2-64561 allows remote attackers to obtain user… Affected: 1.2 before 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; +1 more |
| CVE-2022-43932 | 7.5 | Jan 5 | Improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in CGI component in Synology Router Manager (SRM) before… Affected: 1.2 before 1.2.5-8227-6; 1.3 before 1.3.1-9346-3 |
| CVE-2019-11823 | 7.5 | May 4 | CRLF injection vulnerability in Network Center in Synology Router Manager (SRM) before 1.2.3-8017-2 allows remote attackers to cause a denial of service (out-of-bounds read and… Affected: before 1.2.3-8017-2 |
| CVE-2018-7185 | 7.5 | Mar 6 | The protocol engine in ntp 4.2.6 before 4.2.8p11 allows a remote attackers to cause a denial of service (disruption) by continually sending a packet with a zero-origin timestamp… Affected: 1.1 before 1.1.6-6931-3 |
| CVE-2018-7184 | 7.5 | Mar 6 | ntpd in ntp 4.2.8p4 before 4.2.8p11 drops bad packets before updating the "received" timestamp, which allows remote attackers to cause a denial of service (disruption) by sending… Affected: 1.1 |
| CVE-2025-29846 | 7.2 | Dec 4 | A vulnerability in portenable cgi allows remote authenticated users to get the status of installed packages Affected: 1.3 before 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; +8 more |
| CVE-2024-53286 | 7.2 | Jul 23 | Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in DDNS Record functionality in Synology Router Manager (SRM) before… Affected: 1.3 before 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; +6 more |
| CVE-2017-12078 | 7.2 | Jun 8 | Command injection vulnerability in EZ-Internet in Synology Router Manager (SRM) before 1.1.6-6931 allows remote authenticated users to execute arbitrary command via the username… Affected: before 1.1.6-6931 |
| CVE-2023-41739 | 6.5 | Aug 31 | Uncontrolled resource consumption vulnerability in File Functionality in Synology Router Manager (SRM) before 1.3.1-9346-6 allows remote authenticated users to conduct… Affected: before 1.3.1-9346-6 |
| CVE-2019-19344 | 6.5 | Jan 21 | There is a use-after-free issue in all samba 4.9.x versions before 4.9.18, all samba 4.10.x versions before 4.10.12 and all samba 4.11.x versions before 4.11.5, essentially due to… Affected: 1.2 |
| CVE-2019-14907 | 6.5 | Jan 21 | All samba versions 4.9.x before 4.9.18, 4.10.x before 4.10.12 and 4.11.x before 4.11.5 have an issue where if it is set with "log level = 3" (or above) then the string obtained… Affected: 1.2 |
| CVE-2018-13287 | 6.5 | Apr 1 | Incorrect default permissions vulnerability in synouser.conf in Synology Router Manager (SRM) before 1.1.7-6941-1 allows remote authenticated users to obtain sensitive information… Affected: before 1.1.7-6941-1 |
| CVE-2017-15895 | 6.5 | Dec 8 | Directory traversal vulnerability in the SYNO.FileStation.Extract in Synology Router Manager (SRM) before 1.1.5-6542-4 allows remote authenticated users to write arbitrary files… Affected: before 1.1.5-6542-4 |
| CVE-2020-27658 | 6.1 | Oct 29 | Synology Router Manager (SRM) before 1.2.4-8081 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to… Affected: 1.2 before 1.2.4-8081 |
| CVE-2019-3870 | 6.1 | Apr 9 | A vulnerability was found in Samba from version (including) 4.9 to versions before 4.9.6 and 4.10.2 Affected: 1.2 |
| CVE-2024-53288 | 5.9 | Jul 23 | Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in NTP Region functionality in Synology Router Manager (SRM) before… Affected: 1.3 before 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; +6 more |
| CVE-2024-53287 | 5.9 | Jul 23 | Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in VPN Setting functionality in Synology Router Manager (SRM) before… Affected: 1.3 before 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; +6 more |
| CVE-2024-53285 | 5.9 | Dec 9 | Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in DDNS Record functionality in Synology Router Manager (SRM) before… Affected: 1.3 before 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; +5 more |
| CVE-2024-53284 | 5.9 | Dec 9 | Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in WiFi Connect Setting functionality in Synology Router Manager (SRM) before… Affected: 1.3 before 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; +5 more |
| CVE-2024-53283 | 5.9 | Dec 9 | Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Router Port Forward functionality in Synology Router Manager (SRM) before… Affected: 1.3 before 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; +5 more |
| CVE-2024-53282 | 5.9 | Dec 9 | Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in WiFi Connect MAC Filter functionality in Synology Router Manager (SRM) before… Affected: 1.3 before 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; +5 more |
| CVE-2024-53281 | 5.9 | Dec 9 | Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Network WOL functionality in Synology Router Manager (SRM) before… Affected: 1.3 before 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; +5 more |
| CVE-2024-53279 | 5.9 | Dec 9 | Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in file station functionality in Synology Router Manager (SRM) before… Affected: 1.3 before 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; +5 more |
| CVE-2024-53280 | 5.9 | Dec 9 | Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in network center policy route functionality in Synology Router Manager (SRM)… Affected: 1.3 before 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; +5 more |
| CVE-2024-39347 | 5.9 | Jun 28 | Incorrect default permissions vulnerability in firewall functionality in Synology Router Manager (SRM) before 1.2.5-8227-11 and 1.3.1-9346-8 allows man-in-the-middle attackers to… Affected: 1.2 before 1.2.5-8227; 1.3 before 1.3.1-9346; 1.2.5-8227; 1.2.5-8227; 1.2.5-8227; 1.2.5-8227; +15 more |
| CVE-2020-27657 | 5.9 | Oct 29 | Cleartext transmission of sensitive information vulnerability in DDNS in Synology Router Manager (SRM) before 1.2.4-8081 allows man-in-the-middle attackers to eavesdrop… Affected: 1.2 before 1.2.4-8081 |
| CVE-2019-9494 | 5.9 | Apr 17 | The implementations of SAE in hostapd and wpa_supplicant are vulnerable to side channel attacks as a result of observable timing differences and cache access patterns Affected: before 1.2.3-8087 |
| CVE-2025-29843 | 5.4 | Dec 4 | A vulnerability in FileStation thumb cgi allows remote authenticated users to read/write image files Affected: 1.3 before 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; +8 more |
| CVE-2018-8918 | 5.4 | Dec 24 | Cross-site scripting (XSS) vulnerability in info.cgi in Synology Router Manager (SRM) before 1.1.7-6941 allows remote attackers to inject arbitrary web script or HTML via the host… Affected: before 1.1.7-6941 |
| CVE-2023-41740 | 5.3 | Aug 31 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in cgi component in Synology Router Manager (SRM) before 1.3.1-9346-6 allows remote… Affected: before 1.3.1-9346-6 |