Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

7 records

Release: Synology Router Manager (SRM) 1.2.4-8081 Clear all filters
TI-2020-16773 CVE-2020-27658 · GHSA-3ffh-4665-44q7

Incorrect permission assignment in Synology Router Manager

Priority LOW 34

Synology Router Manager (SRM) before 1.2.4-8081 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.01313 Published 2020-10-29 Fixed in 1.2.4-8081 CWE-1004
TI-2020-16772 CVE-2020-27657 · GHSA-24jw-4h76-4686

Cleartext transmission of sensitive information in Synology Router Manager

Priority LOW 30

Cleartext transmission of sensitive information vulnerability in DDNS in Synology Router Manager (SRM) before 1.2.4-8081 allows man-in-the-middle attackers to eavesdrop authentication information of DNSExit via unspecifi…

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00585 Published 2020-10-29 Fixed in 1.2.4-8081 CWE-319
TI-2020-16770 CVE-2020-27655 · GHSA-wpm2-8qvv-w4q9

Improper privilege management in Synology Router Manager

Priority MEDIUM 46

Improper access control vulnerability in Synology Router Manager (SRM) before 1.2.4-8081 allows remote attackers to access restricted resources via inbound QuickConnect traffic.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.01767 Published 2020-10-29 Fixed in 1.2.4-8081 CWE-269
TI-2020-16769 CVE-2020-27654 · GHSA-6qq4-j9r6-gj4w

Improper privilege management in Synology Router Manager

Priority MEDIUM 50

Improper access control vulnerability in lbd in Synology Router Manager (SRM) before 1.2.4-8081 allows remote attackers to execute arbitrary commands via port (1) 7786/tcp or (2) 7787/tcp.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.04681 Published 2020-10-29 Fixed in 1.2.4-8081 CWE-269
TI-2020-16768 CVE-2020-27653 · GHSA-8wh4-6822-h89q

Broken or risky cryptographic algorithm in Synology Router Manager

Priority LOW 38

Algorithm downgrade vulnerability in QuickConnect in Synology Router Manager (SRM) before 1.2.4-8081 allows man-in-the-middle attackers to spoof servers and obtain sensitive information via unspecified vectors.

CVSS 3.1HIGH 8.3 Network No auth User interaction EPSS 0.00832 Published 2020-10-29 Fixed in 1.2.4-8081 CWE-327
TI-2020-16766 CVE-2020-27651 · GHSA-mxhv-mc3x-7jmr

Synology Router Manager (SRM) before 1.2.4-8081 does not set the Secure flag for the…

Priority LOW 37

Synology Router Manager (SRM) before 1.2.4-8081 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00772 Published 2020-10-29 Fixed in 1.2.4-8081 CWE-614
TI-2020-16764 CVE-2020-27649 · GHSA-pxvm-4ffc-chr4

Improper certificate validation in Synology Router Manager

Priority MEDIUM 40

Improper certificate validation vulnerability in OpenVPN client in Synology Router Manager (SRM) before 1.2.4-8081 allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certif…

CVSS 3.1CRITICAL 9.0 Network No auth No interaction EPSS 0.00719 Published 2020-10-29 Fixed in 1.2.4-8081 CWE-295