PT-2020-4938 · Synology · Synology Router Manager

Claudio Bozzato · Published 2020-10-29 · Updated 2020-11-03 · CVE-2020-27658

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions: Synology Router Manager (SRM) versions prior to 1.2.4-8081

Description: The issue is related to the absence of the HttpOnly flag in session cookies. This makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.

Recommendations: For versions prior to 1.2.4-8081, update to version 1.2.4-8081 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive information until the update is applied.

Exploit

Fix

Incorrect Permission

Weakness Enumeration

CWE-1004

CWE-732

Related Identifiers

BDU:2020-05513

CVE-2020-27658

Affected Products

Synology Router Manager

References · 7

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2020-1086 · Exploit
• https://osv.dev/vulnerability/CVE-2020-27658 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-05513 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-27658 · Security Note
• https://synology.com/security/advisory/Synology_SA_20_14 · Vendor Advisory
• https://synology.com/ru-ru/security/advisory/Synology_SA_20_14 · Note
• https://t.me/cybersecuritytechnologies/2005 · Telegram Post