Synology Router Manager (Srm) vulnerabilities
43 vulnerabilities
Known vulnerabilities in Synology Router Manager (Srm), newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2018-13285synologyrouter_manager+1
EPSS score2.38%
Command injection vulnerability in ftpd in Synology Router Manager (SRM) before 1.1.7-6941-1 allows remote authenticated users to execute arbitrary OS commands via the (1) MKD or (2) RMD command.CVE-2018-13289synologyrouter_manager+1EPSS score1.64%
Information exposure vulnerability in SYNO.FolderSharing.List in Synology Router Manager (SRM) before 1.1.7-6941-2 allows remote attackers to obtain sensitive information via the (1) folder_path or (2) real_path parameter.CVE-2018-13290synologyrouter_manager+1EPSS score1.31%
Information exposure vulnerability in SYNO.Core.ACL in Synology Router Manager (SRM) before 1.1.7-6941-2 allows remote authenticated users to determine the existence of files or obtain sensitive information of files via the file_path parameter.CVE-2018-13292synologyrouter_manager+1EPSS score1.31%
Information exposure vulnerability in /usr/syno/etc/mount.conf in Synology Router Manager (SRM) before 1.1.7-6941-2 allows remote authenticated users to obtain sensitive information via the world readable configuration.CVE-2018-13287synologyrouter_manager+1EPSS score1.34%
Incorrect default permissions vulnerability in synouser.conf in Synology Router Manager (SRM) before 1.1.7-6941-1 allows remote authenticated users to obtain sensitive information via the world readable configuration.CVE-2018-8918synologyrouter_manager+1EPSS score0.80%
Cross-site scripting (XSS) vulnerability in info.cgi in Synology Router Manager (SRM) before 1.1.7-6941 allows remote attackers to inject arbitrary web script or HTML via the host parameter.CVE-2025-29844synologyrouter_manager+1EPSS score0.43%
A vulnerability in FileStation file cgi allows remote authenticated users to read file metadata and path information.CVE-2025-29846synologyrouter_manager+1EPSS score0.64%
A vulnerability in portenable cgi allows remote authenticated users to get the status of installed packages.CVE-2025-29843synologyrouter_manager+1EPSS score0.37%
A vulnerability in FileStation thumb cgi allows remote authenticated users to read/write image files.CVE-2025-29845synologyrouter_manager+1EPSS score0.43%
A vulnerability in VideoPlayer2 subtitle cgi allows remote authenticated users to read .srt files.CVE-2020-27649synologyrouter_manager+1EPSS score0.72%
Improper certificate validation vulnerability in OpenVPN client in Synology Router Manager (SRM) before 1.2.4-8081 allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.CVE-2020-27658synologyrouter_manager+1EPSS score1.31%
Synology Router Manager (SRM) before 1.2.4-8081 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.CVE-2020-27657synologyrouter_manager+1EPSS score0.58%
Cleartext transmission of sensitive information vulnerability in DDNS in Synology Router Manager (SRM) before 1.2.4-8081 allows man-in-the-middle attackers to eavesdrop authentication information of DNSExit via unspecified vectors.CVE-2020-27654synologyrouter_manager+1EPSS score4.68%
Improper access control vulnerability in lbd in Synology Router Manager (SRM) before 1.2.4-8081 allows remote attackers to execute arbitrary commands via port (1) 7786/tcp or (2) 7787/tcp.CVE-2020-27655synologyrouter_manager+1EPSS score1.77%
Improper access control vulnerability in Synology Router Manager (SRM) before 1.2.4-8081 allows remote attackers to access restricted resources via inbound QuickConnect traffic.CVE-2020-27651synologyrouter_manager+1EPSS score0.77%
Synology Router Manager (SRM) before 1.2.4-8081 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session.CVE-2020-27653synologydiskstation_manager+2EPSS score0.83%
Algorithm downgrade vulnerability in QuickConnect in Synology Router Manager (SRM) before 1.2.4-8081 allows man-in-the-middle attackers to spoof servers and obtain sensitive information via unspecified vectors.CVE-2022-43932synologyrouter_manager+1EPSS score1.03%
Improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in CGI component in Synology Router Manager (SRM) before 1.2.5-8227-6 and 1.3.1-9346-3 allows remote attackers to read arbitrary files via unspecified vectors.CVE-2017-15895synologyrouter_manager+1EPSS score1.97%
Directory traversal vulnerability in the SYNO.FileStation.Extract in Synology Router Manager (SRM) before 1.1.5-6542-4 allows remote authenticated users to write arbitrary files via the dest_folder_path parameter.CVE-2017-12078synologyrouter_manager+1EPSS score2.38%
Command injection vulnerability in EZ-Internet in Synology Router Manager (SRM) before 1.1.6-6931 allows remote authenticated users to execute arbitrary command via the username parameter.