Read the docs
TI-2020-16766 Aliases CVE-2020-27651GHSA-mxhv-mc3x-7jmr

Synology Router Manager (SRM) before 1.2.4-8081 does not set the Secure flag for the…

Priority LOW 37CWE-614Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Information disclosure
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-311.

Summary

Synology Router Manager (SRM) before 1.2.4-8081 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session.

Why it matters now

EPSS 0.00772 55th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Synology Router Manager (SRM) (Synology): 1.2.4-8081

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SynologySynology Router Manager (SRM)before 1.2.4-80811.2.4-8081Patch availableCNA
  • Synology Router Manager (SRM) VendorSynology Affected before 1.2.4-8081 Fixed in 1.2.4-8081 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:synology:router_manager:*:*:*:*:*:*:*:*1.2 to before 1.2.4-8081VulnerableSynology
  • cpe:2.3:a:synology:router_manager:*:*:*:*:*:*:*:* Versions 1.2 to before 1.2.4-8081 Vulnerable ·Synology

Remediation

  • Fix · CNA Synology Router Manager (SRM) (Synology) Fixed in 1.2.4-8081

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Synology Router Manager (SRM) 1.2.4-8081

    7 records Highest priority Priority MEDIUM 3 MEDIUM, 4 LOW

    Other records, highest priority first

    • TI-2020-16769 Improper privilege management in Synology Router ManagerPriority MEDIUM 50
    • TI-2020-16770 Improper privilege management in Synology Router ManagerPriority MEDIUM 46
    • TI-2020-16764 Improper certificate validation in Synology Router ManagerPriority MEDIUM 40
    Show all 7 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-27651
  2. 2026-10-03 Alias added: GHSA-mxhv-mc3x-7jmr

References

Exploit 1

Advisory 1

  • TI-2018-01076 Out-of-bounds write in Netatalk CVSS 3.1CRITICAL 9.8
  • TI-2017-10594 Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a… CVSS 3.1CRITICAL 9.8
  • TI-2017-03716 Observable discrepancy in Intel Most Modern Operating Systems CVSS 3.1MEDIUM 5.6
  • TI-2023-16144 Improper neutralization of special elements used in an OS command ('OS Command… CVSS 3.1CRITICAL 9.8
  • TI-2023-00073 Integer overflow or wraparound vulnerability in CGI component in Synology Router Manager… CVSS 3.1CRITICAL 9.8
  • TI-2020-16769 Improper privilege management in Synology Router Manager CVSS 3.1CRITICAL 9.8
See all 58 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences