Synology Router Manager vulnerabilities
59 vulnerabilities
Known vulnerabilities in Synology Router Manager, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2018-13285synologyrouter_manager+1
EPSS score2.38%
Command injection vulnerability in ftpd in Synology Router Manager (SRM) before 1.1.7-6941-1 allows remote authenticated users to execute arbitrary OS commands via the (1) MKD or (2) RMD command.CVE-2018-13289synologyrouter_manager+1EPSS score1.64%
Information exposure vulnerability in SYNO.FolderSharing.List in Synology Router Manager (SRM) before 1.1.7-6941-2 allows remote attackers to obtain sensitive information via the (1) folder_path or (2) real_path parameter.CVE-2018-13290synologyrouter_manager+1EPSS score1.31%
Information exposure vulnerability in SYNO.Core.ACL in Synology Router Manager (SRM) before 1.1.7-6941-2 allows remote authenticated users to determine the existence of files or obtain sensitive information of files via the file_path parameter.CVE-2018-13292synologyrouter_manager+1EPSS score1.31%
Information exposure vulnerability in /usr/syno/etc/mount.conf in Synology Router Manager (SRM) before 1.1.7-6941-2 allows remote authenticated users to obtain sensitive information via the world readable configuration.CVE-2018-13287synologyrouter_manager+1EPSS score1.34%
Incorrect default permissions vulnerability in synouser.conf in Synology Router Manager (SRM) before 1.1.7-6941-1 allows remote authenticated users to obtain sensitive information via the world readable configuration.CVE-2018-1160debiannetatalk+15EPSS score86.54%
Netatalk before 3.1.12 is vulnerable to an out of bounds write in dsi_opensess.c. This is due to lack of bounds checking on attacker controlled data. A remote unauthenticated attacker can leverage this vulnerability to achieve arbitrary code execution.CVE-2018-7184canonicalubuntu_linux+11EPSS score8.63%
ntpd in ntp 4.2.8p4 before 4.2.8p11 drops bad packets before updating the "received" timestamp, which allows remote attackers to cause a denial of service (disruption) by sending a packet with a zero-origin timestamp causing the association to reset and setting the contents of the packet as the most recent timestamp. This issue is a result of an incomplete fix for CVE-2015-7704.CVE-2018-7170debianntp+10EPSS score2.69%
ntpd in ntp 4.2.x before 4.2.8p7 and 4.3.x before 4.3.92 allows authenticated users that know the private symmetric key to create arbitrarily-many ephemeral associations in order to win the clock selection of ntpd and modify a victim's clock via a Sybil attack. This issue exists because of an incomplete fix for CVE-2016-1549.CVE-2018-7185canonicalubuntu_linux+17EPSS score9.00%
The protocol engine in ntp 4.2.6 before 4.2.8p11 allows a remote attackers to cause a denial of service (disruption) by continually sending a packet with a zero-origin timestamp and source IP address of the "other side" of an interleaved association causing the victim ntpd to reset its association.CVE-2018-8918synologyrouter_manager+1EPSS score0.80%
Cross-site scripting (XSS) vulnerability in info.cgi in Synology Router Manager (SRM) before 1.1.7-6941 allows remote attackers to inject arbitrary web script or HTML via the host parameter.CVE-2025-29844synologyrouter_manager+1EPSS score0.43%
A vulnerability in FileStation file cgi allows remote authenticated users to read file metadata and path information.CVE-2025-29846synologyrouter_manager+1EPSS score0.64%
A vulnerability in portenable cgi allows remote authenticated users to get the status of installed packages.CVE-2025-29843synologyrouter_manager+1EPSS score0.37%
A vulnerability in FileStation thumb cgi allows remote authenticated users to read/write image files.CVE-2025-29845synologyrouter_manager+1EPSS score0.43%
A vulnerability in VideoPlayer2 subtitle cgi allows remote authenticated users to read .srt files.CVE-2020-27649synologyrouter_manager+1EPSS score0.72%
Improper certificate validation vulnerability in OpenVPN client in Synology Router Manager (SRM) before 1.2.4-8081 allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.CVE-2020-27658synologyrouter_manager+1EPSS score1.31%
Synology Router Manager (SRM) before 1.2.4-8081 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.CVE-2020-27657synologyrouter_manager+1EPSS score0.58%
Cleartext transmission of sensitive information vulnerability in DDNS in Synology Router Manager (SRM) before 1.2.4-8081 allows man-in-the-middle attackers to eavesdrop authentication information of DNSExit via unspecified vectors.CVE-2020-27654synologyrouter_manager+1EPSS score4.68%
Improper access control vulnerability in lbd in Synology Router Manager (SRM) before 1.2.4-8081 allows remote attackers to execute arbitrary commands via port (1) 7786/tcp or (2) 7787/tcp.CVE-2020-27655synologyrouter_manager+1EPSS score1.77%
Improper access control vulnerability in Synology Router Manager (SRM) before 1.2.4-8081 allows remote attackers to access restricted resources via inbound QuickConnect traffic.CVE-2020-27651synologyrouter_manager+1EPSS score0.77%
Synology Router Manager (SRM) before 1.2.4-8081 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session.