Medium WID-SEC-2023-2242 4 CVEs

Synology Router Manager: Mehrere Schwachstellen

Published Aug 31, 2023 · Updated Aug 31, 2023 · de-DE

Vendor: Synology Product: Router Manager < 1.3.1-9346-6

Summary

Ein entfernter, authentifizierter Angreifer kann mehrere Schwachstellen in Synology Router Manager ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand zu verursachen und vertrauliche Informationen offenzulegen.

Product

Der Synology Router Manager (SRM) ist das Betriebssystem, mit dem jeder Synology Router betrieben wird.

Vulnerabilities 4

High 7.2

CVE-2023-41738

Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in Directory D…

Synology Synology Router Manager (SRM)

Aug 31, 2023
Medium 5.3

CVE-2023-41740

Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in cgi component in Synolo…

Synology Synology Router Manager (SRM)

Aug 31, 2023
Medium 5.3

CVE-2023-41741

Exposure of sensitive information to an unauthorized actor vulnerability in cgi component in Synology Router Manager (S…

Synology Synology Router Manager (SRM)

Aug 31, 2023
Medium 4.9

CVE-2023-41739

Uncontrolled resource consumption vulnerability in File Functionality in Synology Router Manager (SRM) before 1.3.1-934…

Synology Synology Router Manager (SRM)

Aug 31, 2023

Revision history

2023-08-31 #1
Initiale Fassung

References

Synology Security Advisory - SA-23:10 SRM vom 2023-08-31
https://www.synology.com/en-global/security/advisory/Synology_SA_23_10