PT-2020-4927 · Synology · Synology Router Manager

Published 2020-10-29 · Updated 2025-01-14 · CVE-2020-27653

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Synology Router Manager (SRM) versions prior to 1.2.4-8081

Description: The issue concerns a problem with the QuickConnect feature in Synology Router Manager, which allows for a man-in-the-middle attack. This could enable an attacker to spoof servers and obtain sensitive information. The vulnerability is related to the use of defective cryptographic algorithms in the HTTP connection function.

Recommendations: For Synology Router Manager (SRM) versions prior to 1.2.4-8081, update to version 1.2.4-8081 or later to resolve the issue. As a temporary workaround, consider restricting access to the QuickConnect feature until the update is applied.

Exploit

Fix

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-757

CWE-327

Related Identifiers

BDU:2020-05502

CVE-2020-27653

Affected Products

Synology Router Manager

References · 7

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2020-1061 · Exploit
• https://synology.com/security/advisory/Synology_SA_20_14 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-27653 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-27653 · Security Note
• https://bdu.fstec.ru/vul/2020-05502 · Security Note
• https://synology.com/ru-ru/security/advisory/Synology_SA_20_14 · Note
• https://t.me/cybersecuritytechnologies/2005 · Telegram Post