PT-2018-18716 · Synology · Synology Router Manager

Published 2018-12-24 · Updated 2019-10-09 · CVE-2018-8918

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Synology Router Manager (SRM) versions prior to 1.1.7-6941

Description A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved via the host parameter in the info.cgi file.

Recommendations For versions prior to 1.1.7-6941, update to version 1.1.7-6941 or later to resolve the issue. As a temporary workaround, consider restricting access to the info.cgi file to minimize the risk of exploitation. Avoid using the host parameter in the affected API endpoint until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-8918

Affected Products

Synology Router Manager

References · 3

• https://osv.dev/vulnerability/CVE-2018-8918 · Vendor Advisory
• https://synology.com/security/advisory/Synology_SA_18_25 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-8918 · Security Note