Synology Synology Router Manager (SRM)

• CVE-2025-29846 High 7.2 A vulnerability in portenable cgi allows remote authenticated users to get the status of installed packages. 0.7%
• CVE-2025-29845 Medium 4.3 A vulnerability in VideoPlayer2 subtitle cgi allows remote authenticated users to read .srt files. 0.5%
• CVE-2025-29844 Medium 4.3 A vulnerability in FileStation file cgi allows remote authenticated users to read file metadata and path information. 0.5%
• CVE-2025-29843 Medium 5.4 A vulnerability in FileStation thumb cgi allows remote authenticated users to read/write image files. 0.4%
• CVE-2024-53288 Medium 5.9 Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in NTP Region functionality in Synology Router Manager (SRM) before 1.3.1-9346-11 allows remote authe 0.2%
• CVE-2024-53287 Medium 5.9 Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in VPN Setting functionality in Synology Router Manager (SRM) before 1.3.1-9346-11 allows remote auth 0.2%
• CVE-2024-53286 High 7.2 Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in DDNS Record functionality in Synology Router Manager (SRM) before 1.3.1-9346-11 allows remot 1.2%
• CVE-2024-53285 Medium 5.9 Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in DDNS Record functionality in Synology Router Manager (SRM) before 1.3.1-9346-10 allows remote auth 0.3%
• CVE-2024-53284 Medium 5.9 Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in WiFi Connect Setting functionality in Synology Router Manager (SRM) before 1.3.1-9346-10 allows re 0.3%
• CVE-2024-53283 Medium 5.9 Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Router Port Forward functionality in Synology Router Manager (SRM) before 1.3.1-9346-10 allows rem 0.3%
• CVE-2024-53282 Medium 5.9 Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in WiFi Connect MAC Filter functionality in Synology Router Manager (SRM) before 1.3.1-9346-10 allows 0.3%
• CVE-2024-53281 Medium 5.9 Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Network WOL functionality in Synology Router Manager (SRM) before 1.3.1-9346-10 allows remote auth 0.3%
• CVE-2024-53279 Medium 5.9 Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in file station functionality in Synology Router Manager (SRM) before 1.3.1-9346-10 allows remote aut 0.3%
• CVE-2024-53280 Medium 5.9 Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in network center policy route functionality in Synology Router Manager (SRM) before 1.3.1-9346-10 al 0.3%
• CVE-2024-11398 High 8.1 Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in OTP reset functionality in Synology Router Manager (SRM) before 1.3.1-9346-9 allows remote authenticated 0.6%
• CVE-2024-39348 High 7.5 Download of code without integrity check vulnerability in AirPrint functionality in Synology Router Manager (SRM) before 1.2.5-8227-11 and 1.3.1-9346-8 allows man-in-the-middle attackers to execute ar 0.3%
• CVE-2024-39347 Medium 5.9 Incorrect default permissions vulnerability in firewall functionality in Synology Router Manager (SRM) before 1.2.5-8227-11 and 1.3.1-9346-8 allows man-in-the-middle attackers to access highly sensiti 0.5%
• CVE-2023-41741 Medium 5.3 Exposure of sensitive information to an unauthorized actor vulnerability in cgi component in Synology Router Manager (SRM) before 1.3.1-9346-6 allows remote attackers to obtain sensitive information v 0.7%
• CVE-2023-41740 Medium 5.3 Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in cgi component in Synology Router Manager (SRM) before 1.3.1-9346-6 allows remote attackers to read speci 0.8%
• CVE-2023-41739 Medium 4.9 Uncontrolled resource consumption vulnerability in File Functionality in Synology Router Manager (SRM) before 1.3.1-9346-6 allows remote authenticated users to conduct denial-of-service attacks via un 0.8%
• CVE-2023-41738 High 7.2 Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in Directory Domain Functionality in Synology Router Manager (SRM) before 1.3.1-9346-6 allows r 1.5%
• CVE-2023-2729 Medium 5.9 Use of insufficiently random values vulnerability in User Management Functionality in Synology DiskStation Manager (DSM) before 7.2-64561 allows remote attackers to obtain user credential via unspecif 0.9%
• CVE-2023-0142 Medium 6.5 Uncontrolled search path element vulnerability in Backup Management functionality in Synology DiskStation Manager (DSM) before 6.2.4-25556-8, 7.0.1-42218-7 and 7.1-42661 allows remote authenticated us 1.0%
• CVE-2023-32956 Critical 9.8 Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in CGI component in Synology Router Manager (SRM) before 1.2.5-8227-6 and 1.3.1-9346-3 allows r 1.5%
• CVE-2023-32955 High 8.1 Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in DHCP Client Functionality in Synology Router Manager (SRM) before 1.2.5-8227-6 and 1.3.1-934 1.2%
• CVE-2023-0077 Medium 6.5 Integer overflow or wraparound vulnerability in CGI component in Synology Router Manager (SRM) before 1.2.5-8227-6 and 1.3.1-9346-3 allows remote attackers to overflow buffers via unspecified vectors. 1.0%
• CVE-2022-43932 High 7.5 Improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in CGI component in Synology Router Manager (SRM) before 1.2.5-8227-6 and 1.3.1-9346-3 1.1%
• CVE-2020-27658 High 7.1 Synology Router Manager (SRM) before 1.2.4-8081 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensi 1.3%
• CVE-2020-27657 Medium 6.5 Cleartext transmission of sensitive information vulnerability in DDNS in Synology Router Manager (SRM) before 1.2.4-8081 allows man-in-the-middle attackers to eavesdrop authentication information of D 0.6%
• CVE-2020-27655 Medium 6.5 Improper access control vulnerability in Synology Router Manager (SRM) before 1.2.4-8081 allows remote attackers to access restricted resources via inbound QuickConnect traffic. 1.8%
• CVE-2020-27654 Critical 9.8 Improper access control vulnerability in lbd in Synology Router Manager (SRM) before 1.2.4-8081 allows remote attackers to execute arbitrary commands via port (1) 7786/tcp or (2) 7787/tcp. 4.7%
• CVE-2020-27653 High 8.3 Algorithm downgrade vulnerability in QuickConnect in Synology Router Manager (SRM) before 1.2.4-8081 allows man-in-the-middle attackers to spoof servers and obtain sensitive information via unspecifie 0.8%
• CVE-2020-27651 Medium 5.8 Synology Router Manager (SRM) before 1.2.4-8081 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepti 0.8%
• CVE-2020-27649 High 8.3 Improper certificate validation vulnerability in OpenVPN client in Synology Router Manager (SRM) before 1.2.4-8081 allows man-in-the-middle attackers to spoof servers and obtain sensitive information 0.7%