Read the docs

Synology

Records375All Threatist records
Exploited (KEV)2In CISA KEV
CVSS critical61CVSS 9.0–10.0
CVSS high133CVSS 7.0–8.9

Exploited now

Synology records in CISA KEV
TI-2021-02242 Sudo Heap-Based Buffer Overflow Vulnerability Priority CRITICAL 93KEV 2022-04-06TI-2020-01431 Microsoft Netlogon Privilege Escalation Vulnerability Priority CRITICAL 100KEV 2021-11-03

Components

Products in the NVD configurations · select one to filter the records
Diskstation Manager 97 records CRITICAL Router Manager 59 records CRITICAL Photo Station 33 records HIGH Surveillance Station 25 records MEDIUM Vs960hd Firmware 22 records CRITICAL Diskstation Manager Unified Controller 20 records CRITICAL Skynas 16 records CRITICAL Skynas Firmware 13 records CRITICAL

Records

59 records in Router Manager · all components

TI-2018-01076 CVE-2018-1160 · GHSA-j675-7hvj-qfw5

Out-of-bounds write in Netatalk

Priority CRITICAL 91

Netatalk before 3.1.12 is vulnerable to an out of bounds write in dsi_opensess.c.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.86424 Published 2018-12-20 Fixed in 3.1.12 CWE-787
TI-2017-03716 CVE-2017-5753

Observable discrepancy in Intel Most Modern Operating Systems

Priority HIGH 69

Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis.

CVSS 3.1MEDIUM 5.6 Local Low privileges No interaction EPSS 0.93838 Published 2018-01-04 Fixed CWE-203
TI-2023-16144 CVE-2023-32956 · GHSA-44px-68jg-57xp

Improper neutralization of special elements used in an OS command ('OS Command…

Priority MEDIUM 52

Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in CGI component in Synology Router Manager (SRM) before 1.2.5-8227-6 and 1.3.1-9346-3 allows remote attackers to e…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01534 Published 2023-05-16 Fixed in 1.3.1-9346-3, 1.2.5-8227-6
TI-2020-16769 CVE-2020-27654 · GHSA-6qq4-j9r6-gj4w

Improper privilege management in Synology Router Manager

Priority MEDIUM 50

Improper access control vulnerability in lbd in Synology Router Manager (SRM) before 1.2.4-8081 allows remote attackers to execute arbitrary commands via port (1) 7786/tcp or (2) 7787/tcp.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.04681 Published 2020-10-29 Fixed in 1.2.4-8081 CWE-269
TI-2020-16770 CVE-2020-27655 · GHSA-wpm2-8qvv-w4q9

Improper privilege management in Synology Router Manager

Priority MEDIUM 46

Improper access control vulnerability in Synology Router Manager (SRM) before 1.2.4-8081 allows remote attackers to access restricted resources via inbound QuickConnect traffic.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.01767 Published 2020-10-29 Fixed in 1.2.4-8081 CWE-269
TI-2023-22153 CVE-2023-41738 · GHSA-7jqv-587h-9mvw

Improper neutralization of special elements used in an OS command ('OS Command…

Priority MEDIUM 43

Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in Directory Domain Functionality in Synology Router Manager (SRM) before 1.3.1-9346-6 allows remote authenticated…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0154 Published 2023-08-31 Fixed in 1.3.1-9346-6
TI-2018-09533 CVE-2018-13285 · GHSA-7vx4-7pxq-c7q2

OS command injection in Synology Router Manager

Priority MEDIUM 43

Command injection vulnerability in ftpd in Synology Router Manager (SRM) before 1.1.7-6941-1 allows remote authenticated users to execute arbitrary OS commands via the (1) MKD or (2) RMD command.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.02376 Published 2019-04-01 Fixed in 1.1.7-6941-1 CWE-78
TI-2019-08860 CVE-2019-11823 · GHSA-x39q-8mm3-jqpx

Out-of-bounds read in Synology Router Manager

Priority MEDIUM 42

CRLF injection vulnerability in Network Center in Synology Router Manager (SRM) before 1.2.3-8017-2 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via crafted network traf…

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.02507 Published 2020-05-04 Fixed in 1.2.3-8017-2 CWE-125
TI-2022-21579 CVE-2022-43932 · GHSA-68gv-8qjc-g598

Improper neutralization of special elements in output used by a downstream component…

Priority MEDIUM 41

Improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in CGI component in Synology Router Manager (SRM) before 1.2.5-8227-6 and 1.3.1-9346-3 allows remote attack…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01064 Published 2023-01-05 Fixed in 1.2.5-8227-6, 1.3.1-9346-3
TI-2023-22156 CVE-2023-41741 · GHSA-5m7w-3v9x-xj3w

Exposure of sensitive information to an unauthorized actor vulnerability in cgi component…

Priority MEDIUM 40

Exposure of sensitive information to an unauthorized actor vulnerability in cgi component in Synology Router Manager (SRM) before 1.3.1-9346-6 allows remote attackers to obtain sensitive information via unspecified vecto…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00718 Published 2023-08-31 Fixed in 1.3.1-9346-6
TI-2023-16143 CVE-2023-32955 · GHSA-6cxc-x48g-7mv3

Improper neutralization of special elements used in an OS command ('OS Command…

Priority MEDIUM 40

Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in DHCP Client Functionality in Synology Router Manager (SRM) before 1.2.5-8227-6 and 1.3.1-9346-3 allows man-in-th…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.01205 Published 2023-05-16 Fixed in 1.2.5-8227-6, 1.3.1-9346-3
TI-2020-16764 CVE-2020-27649 · GHSA-pxvm-4ffc-chr4

Improper certificate validation in Synology Router Manager

Priority MEDIUM 40

Improper certificate validation vulnerability in OpenVPN client in Synology Router Manager (SRM) before 1.2.4-8081 allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certif…

CVSS 3.1CRITICAL 9.0 Network No auth No interaction EPSS 0.00719 Published 2020-10-29 Fixed in 1.2.4-8081 CWE-295
TI-2019-06935 CVE-2019-9499 · GHSA-qppx-fffq-j22m

Origin validation error in Wi-Fi Alliance hostapd with EAP-pwd support

Priority MEDIUM 40

The implementations of EAP-PWD in wpa_supplicant EAP Peer, when built against a crypto library missing explicit validation on imported elements, do not validate the scalar and element values in EAP-pwd-Commit.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.02215 Published 2019-04-17 No fix listed CWE-346
TI-2019-06934 CVE-2019-9498 · GHSA-vv3p-4cq3-5ppc

The implementations of EAP-PWD in hostapd EAP Server do not validate the scalar and element values in EAP-pwd-Commit

Priority MEDIUM 40

The implementations of EAP-PWD in hostapd EAP Server, when built against a crypto library missing explicit validation on imported elements, do not validate the scalar and element values in EAP-pwd-Commit.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.02215 Published 2019-04-17 No fix listed CWE-346
TI-2023-00137 CVE-2023-0142 · GHSA-8f24-4fhw-xqcc

Uncontrolled search path in Synology DiskStation Manager

Priority LOW 39

Uncontrolled search path element vulnerability in Backup Management functionality in Synology DiskStation Manager (DSM) before 6.2.4-25556-8, 7.0.1-42218-7 and 7.1-42661 allows remote authenticated users with administrat…

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.0097 Published 2023-06-13 Fixed in 7.2, 7.1-42661 +2 CWE-427
TI-2020-16768 CVE-2020-27653 · GHSA-8wh4-6822-h89q

Broken or risky cryptographic algorithm in Synology Router Manager

Priority LOW 38

Algorithm downgrade vulnerability in QuickConnect in Synology Router Manager (SRM) before 1.2.4-8081 allows man-in-the-middle attackers to spoof servers and obtain sensitive information via unspecified vectors.

CVSS 3.1HIGH 8.3 Network No auth User interaction EPSS 0.00832 Published 2020-10-29 Fixed in 1.2.4-8081 CWE-327
TI-2020-16766 CVE-2020-27651 · GHSA-mxhv-mc3x-7jmr

Synology Router Manager (SRM) before 1.2.4-8081 does not set the Secure flag for the…

Priority LOW 37

Synology Router Manager (SRM) before 1.2.4-8081 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00772 Published 2020-10-29 Fixed in 1.2.4-8081 CWE-614
TI-2024-35748 CVE-2024-53286 · GHSA-wv44-h7fg-jf4w

OS command injection in Synology Router Manager

Priority LOW 36

Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in DDNS Record functionality in Synology Router Manager (SRM) before 1.3.1-9346-11 allows remote authenticated user…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.012 Published 2025-07-23 Fixed in 1.3.1-9346-11 CWE-78
TI-2024-10561 CVE-2024-11398 · GHSA-79vx-rgpq-6669

Path traversal in Synology Router Manager

Priority LOW 36

Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in OTP reset functionality in Synology Router Manager (SRM) before 1.3.1-9346-9 allows remote authenticated users to delete arb…

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00645 Published 2024-12-04 Fixed in 1.3.1-9346-9 CWE-22
Load more
Open these records in search →