router manager · threatengine.sh

Home/Product/synology router manager

Product

synology router manager

59 known vulnerabilities across versions

Vulnerabilities are listed by affected version. Select any CVE for the full briefing and its intelligence graph.

Sort Min CVSS Published since

>= 1.3 and < 1.3.1-9346

A vulnerability in portenable cgi allows remote authenticated users to get the status of installed packages.

>= 1.3 and < 1.3.1-9346

A vulnerability in VideoPlayer2 subtitle cgi allows remote authenticated users to read .srt files.

>= 1.3 and < 1.3.1-9346

A vulnerability in FileStation file cgi allows remote authenticated users to read file metadata and path information.

>= 1.3 and < 1.3.1-9346

A vulnerability in FileStation thumb cgi allows remote authenticated users to read/write image files.

>= 1.3 and < 1.3.1-9346

Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in NTP Region functionality in

>= 1.3 and < 1.3.1-9346

Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in VPN Setting functionality in

>= 1.3 and < 1.3.1-9346

Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in DDNS Record functional

>= 1.3 and < 1.3.1-9346

Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in DDNS Record functionality in

>= 1.3 and < 1.3.1-9346

Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in WiFi Connect Setting functio

>= 1.3 and < 1.3.1-9346

Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Router Port Forward function

>= 1.3 and < 1.3.1-9346

Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in WiFi Connect MAC Filter func

>= 1.3 and < 1.3.1-9346

Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Network WOL functionality in

>= 1.3 and < 1.3.1-9346

Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in network center policy route

>= 1.3 and < 1.3.1-9346

Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in file station functionality i

>= 1.3 and < 1.3.1-9346

Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in OTP reset functionality in Synolog

>= 1.2 and < 1.2.5-8227

Download of code without integrity check vulnerability in AirPrint functionality in Synology Router Manager (SRM) before 1.2.5-822

>= 1.2 and < 1.2.5-8227

Incorrect default permissions vulnerability in firewall functionality in Synology Router Manager (SRM) before 1.2.5-8227-11 and 1.

Exposure of sensitive information to an unauthorized actor vulnerability in cgi component in Synology Router Manager (SRM) before

Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in cgi component in Synology Router M

Uncontrolled resource consumption vulnerability in File Functionality in Synology Router Manager (SRM) before 1.3.1-9346-6 allows

Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in Directory Domain Funct

>= 1.2 and < 1.3.1-9346

Use of insufficiently random values vulnerability in User Management Functionality in Synology DiskStation Manager (DSM) before 7.

>= 1.2 and < 1.3.1-9346

Uncontrolled search path element vulnerability in Backup Management functionality in Synology DiskStation Manager (DSM) before 6.2

>= 1.2 and < 1.2.5-8227-6

Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in CGI component in Synol

>= 1.2 and < 1.2.5-8227-6

Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in DHCP Client Functional

>= 1.2 and < 1.2.5-8227-6

Integer overflow or wraparound vulnerability in CGI component in Synology Router Manager (SRM) before 1.2.5-8227-6 and 1.3.1-9346-

>= 1.2 and < 1.2.5-8227-6

Improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in CGI component

>= 1.2 and < 1.2.4-8081

Synology Router Manager (SRM) before 1.2.4-8081 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie,

>= 1.2 and < 1.2.4-8081

Cleartext transmission of sensitive information vulnerability in DDNS in Synology Router Manager (SRM) before 1.2.4-8081 allows ma

>= 1.2 and < 1.2.4-8081

Improper access control vulnerability in Synology Router Manager (SRM) before 1.2.4-8081 allows remote attackers to access restric

Improper access control vulnerability in lbd in Synology Router Manager (SRM) before 1.2.4-8081 allows remote attackers to execute

>= 1.2 and < 1.2.4-8081

Algorithm downgrade vulnerability in QuickConnect in Synology Router Manager (SRM) before 1.2.4-8081 allows man-in-the-middle atta

>= 1.2 and < 1.2.4-8081

Synology Router Manager (SRM) before 1.2.4-8081 does not set the Secure flag for the session cookie in an HTTPS session, which mak

>= 1.2 and < 1.2.4-8081

Improper certificate validation vulnerability in OpenVPN client in Synology Router Manager (SRM) before 1.2.4-8081 allows man-in-t

CRLF injection vulnerability in Network Center in Synology Router Manager (SRM) before 1.2.3-8017-2 allows remote attackers to cau

The Broadcom wl WiFi driver is vulnerable to a heap buffer overflow. If the vendor information element data length is larger than

The Broadcom wl WiFi driver is vulnerable to a heap buffer overflow. By supplying a vendor information element with a data length

There is a use-after-free issue in all samba 4.9.x versions before 4.9.18, all samba 4.10.x versions before 4.10.12 and all samba

All samba versions 4.9.x before 4.9.18, 4.10.x before 4.10.12 and 4.11.x before 4.11.5 have an issue where if it is set with "log

The implementations of EAP-PWD in wpa_supplicant EAP Peer, when built against a crypto library missing explicit validation on impo

The implementations of EAP-PWD in hostapd EAP Server, when built against a crypto library missing explicit validation on imported

The implementations of EAP-PWD in hostapd and wpa_supplicant are vulnerable to side-channel attacks as a result of cache access pa

The implementations of SAE in hostapd and wpa_supplicant are vulnerable to side channel attacks as a result of observable timing d

A vulnerability was found in Samba from version (including) 4.9 to versions before 4.9.6 and 4.10.2. During the creation of a new

>= 1.1 and < 1.1.7-6941-2

Information exposure vulnerability in /usr/syno/etc/mount.conf in Synology Router Manager (SRM) before 1.1.7-6941-2 allows remote

>= 1.1 and < 1.1.7-6941-2

Information exposure vulnerability in SYNO.Core.ACL in Synology Router Manager (SRM) before 1.1.7-6941-2 allows remote authenticat

>= 1.1 and < 1.1.7-6941-2

Information exposure vulnerability in SYNO.FolderSharing.List in Synology Router Manager (SRM) before 1.1.7-6941-2 allows remote a

Incorrect default permissions vulnerability in synouser.conf in Synology Router Manager (SRM) before 1.1.7-6941-1 allows remote au

>= 1.1 and < 1.1.7-6941-1

Command injection vulnerability in ftpd in Synology Router Manager (SRM) before 1.1.7-6941-1 allows remote authenticated users to

Cross-site scripting (XSS) vulnerability in info.cgi in Synology Router Manager (SRM) before 1.1.7-6941 allows remote attackers to

>= 1.2 and < 1.2-7742-5

Netatalk before 3.1.12 is vulnerable to an out of bounds write in dsi_opensess.c. This is due to lack of bounds checking on attack

Command injection vulnerability in EZ-Internet in Synology Router Manager (SRM) before 1.1.6-6931 allows remote authenticated user

>= 1.1 and < 1.1.6-6931-3

The protocol engine in ntp 4.2.6 before 4.2.8p11 allows a remote attackers to cause a denial of service (disruption) by continuall

ntpd in ntp 4.2.8p4 before 4.2.8p11 drops bad packets before updating the "received" timestamp, which allows remote attackers to c

>= 1.1 and < 1.1.6-6931-3

ntpd in ntp 4.2.x before 4.2.8p7 and 4.3.x before 4.3.92 allows authenticated users that know the private symmetric key to create

>= 1.1 and < 1.1.7-6941-1

Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of informatio

Directory traversal vulnerability in the SYNO.FileStation.Extract in Synology Router Manager (SRM) before 1.1.5-6542-4 allows remo

Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrar

<= 1.1.3-6447-4

Uncontrolled Resource Consumption vulnerability in SYNO.Core.PortForwarding.Rules in Synology Router Manager (SRM) before 1.1.4-65

Vulnerabilities
CISA KEV catalog
CWE weaknesses
CAPEC attack patterns
Package vulnerabilities

Threat intelligence
Threat actors
Tools & malware
ATT&CK techniques
IOCs

Detection & defense
Sigma rules
YARA rules
Atomic Red Team tests
D3FEND countermeasures

Compliance
NIST 800-53
ISO 27001:2022
SOC 2 TSC
PCI-DSS v4.0
CIS Controls v8.1

About
All capabilities
Live statistics
Data sources
Privacy policy
Terms of service

threatengine.sh · Open-source threat intelligence platform · 100+ authoritative sources · Every fact traces to its origin