RM
Product
Router Manager
58
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 7High 21Medium 29Low 1
Watch
Add Router Manager to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-41738 | 8.8 | Aug 31 | Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in Directory Domain Functionality in Synology Router Manager (SRM) before… Affected: before 1.3.1-9346-6 |
| CVE-2019-9502 | 8.8 | Feb 3 | The Broadcom wl WiFi driver is vulnerable to a heap buffer overflow Affected: 1.2 |
| CVE-2019-9501 | 8.8 | Feb 3 | The Broadcom wl WiFi driver is vulnerable to a heap buffer overflow Affected: 1.2 |
| CVE-2018-13285 | 8.8 | Apr 1 | Command injection vulnerability in ftpd in Synology Router Manager (SRM) before 1.1.7-6941-1 allows remote authenticated users to execute arbitrary OS commands via the (1) MKD or… Affected: 1.1 before 1.1.7-6941-1 |
| CVE-2020-27653 | 8.3 | Oct 29 | Algorithm downgrade vulnerability in QuickConnect in Synology Router Manager (SRM) before 1.2.4-8081 allows man-in-the-middle attackers to spoof servers and obtain sensitive… Affected: 1.2 before 1.2.4-8081 |
| CVE-2024-11398 | 8.1 | Dec 4 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in OTP reset functionality in Synology Router Manager (SRM) before 1.3.1-9346-9 allows… Affected: 1.3 before 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; +4 more |
| CVE-2023-0142 | 8.1 | Jun 13 | Uncontrolled search path element vulnerability in Backup Management functionality in Synology DiskStation Manager (DSM) before 6.2.4-25556-8, 7.0.1-42218-7 and 7.1-42661 allows… Affected: 1.2 before 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; +1 more |
| CVE-2023-32955 | 8.1 | May 16 | Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in DHCP Client Functionality in Synology Router Manager (SRM) before… Affected: 1.2 before 1.2.5-8227-6; 1.3 before 1.3.1-9346-3 |
| CVE-2020-27651 | 8.1 | Oct 29 | Synology Router Manager (SRM) before 1.2.4-8081 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this… Affected: 1.2 before 1.2.4-8081 |
| CVE-2019-9499 | 8.1 | Apr 17 | The implementations of EAP-PWD in wpa_supplicant EAP Peer, when built against a crypto library missing explicit validation on imported elements, do not validate the scalar and… Affected: 1.2 |
| CVE-2019-9498 | 8.1 | Apr 17 | The implementations of EAP-PWD in hostapd EAP Server, when built against a crypto library missing explicit validation on imported elements, do not validate the scalar and element… Affected: 1.2 |
| CVE-2024-39348 | 7.5 | Jun 28 | Download of code without integrity check vulnerability in AirPrint functionality in Synology Router Manager (SRM) before 1.2.5-8227-11 and 1.3.1-9346-8 allows man-in-the-middle… Affected: 1.2 before 1.2.5-8227; 1.3 before 1.3.1-9346; 1.2.5-8227; 1.2.5-8227; 1.2.5-8227; 1.2.5-8227; +15 more |
| CVE-2023-41741 | 7.5 | Aug 31 | Exposure of sensitive information to an unauthorized actor vulnerability in cgi component in Synology Router Manager (SRM) before 1.3.1-9346-6 allows remote attackers to obtain… Affected: before 1.3.1-9346-6 |
| CVE-2023-2729 | 7.5 | Jun 13 | Use of insufficiently random values vulnerability in User Management Functionality in Synology DiskStation Manager (DSM) before 7.2-64561 allows remote attackers to obtain user… Affected: 1.2 before 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; +1 more |
| CVE-2022-43932 | 7.5 | Jan 5 | Improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in CGI component in Synology Router Manager (SRM) before… Affected: 1.2 before 1.2.5-8227-6; 1.3 before 1.3.1-9346-3 |
| CVE-2019-11823 | 7.5 | May 4 | CRLF injection vulnerability in Network Center in Synology Router Manager (SRM) before 1.2.3-8017-2 allows remote attackers to cause a denial of service (out-of-bounds read and… Affected: before 1.2.3-8017-2 |
| CVE-2018-7185 | 7.5 | Mar 6 | The protocol engine in ntp 4.2.6 before 4.2.8p11 allows a remote attackers to cause a denial of service (disruption) by continually sending a packet with a zero-origin timestamp… Affected: 1.1 before 1.1.6-6931-3 |
| CVE-2018-7184 | 7.5 | Mar 6 | ntpd in ntp 4.2.8p4 before 4.2.8p11 drops bad packets before updating the "received" timestamp, which allows remote attackers to cause a denial of service (disruption) by sending… Affected: 1.1 |
| CVE-2025-29846 | 7.2 | Dec 4 | A vulnerability in portenable cgi allows remote authenticated users to get the status of installed packages Affected: 1.3 before 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; +8 more |
| CVE-2024-53286 | 7.2 | Jul 23 | Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in DDNS Record functionality in Synology Router Manager (SRM) before… Affected: 1.3 before 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; 1.3.1-9346; +6 more |
| CVE-2017-12078 | 7.2 | Jun 8 | Command injection vulnerability in EZ-Internet in Synology Router Manager (SRM) before 1.1.6-6931 allows remote authenticated users to execute arbitrary command via the username… Affected: before 1.1.6-6931 |
Showing 21