Read the docs
TI-2020-16773 Aliases CVE-2020-27658GHSA-3ffh-4665-44q7

Incorrect permission assignment in Synology Router Manager

Priority LOW 34CWE-1004Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Synology Router Manager (SRM) before 1.2.4-8081 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.

Why it matters now

EPSS 0.01313 70th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Synology Router Manager (SRM) (Synology): 1.2.4-8081

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SynologySynology Router Manager (SRM)before 1.2.4-80811.2.4-8081Patch availableCNA
  • Synology Router Manager (SRM) VendorSynology Affected before 1.2.4-8081 Fixed in 1.2.4-8081 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:synology:router_manager:*:*:*:*:*:*:*:*1.2 to before 1.2.4-8081VulnerableSynology
  • cpe:2.3:a:synology:router_manager:*:*:*:*:*:*:*:* Versions 1.2 to before 1.2.4-8081 Vulnerable ·Synology

Remediation

  • Fix · CNA Synology Router Manager (SRM) (Synology) Fixed in 1.2.4-8081

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Synology Router Manager (SRM) 1.2.4-8081

    7 records Highest priority Priority MEDIUM 3 MEDIUM, 4 LOW

    Other records, highest priority first

    • TI-2020-16769 Improper privilege management in Synology Router ManagerPriority MEDIUM 50
    • TI-2020-16770 Improper privilege management in Synology Router ManagerPriority MEDIUM 46
    • TI-2020-16764 Improper certificate validation in Synology Router ManagerPriority MEDIUM 40
    Show all 7 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-27658
  2. 2026-10-03 Alias added: GHSA-3ffh-4665-44q7

References

Exploit 1

Advisory 1

  • TI-2018-01076 Out-of-bounds write in Netatalk CVSS 3.1CRITICAL 9.8
  • TI-2017-10594 Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a… CVSS 3.1CRITICAL 9.8
  • TI-2017-03716 Observable discrepancy in Intel Most Modern Operating Systems CVSS 3.1MEDIUM 5.6
  • TI-2023-16144 Improper neutralization of special elements used in an OS command ('OS Command… CVSS 3.1CRITICAL 9.8
  • TI-2023-00073 Integer overflow or wraparound vulnerability in CGI component in Synology Router Manager… CVSS 3.1CRITICAL 9.8
  • TI-2020-16769 Improper privilege management in Synology Router Manager CVSS 3.1CRITICAL 9.8
See all 58 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences