PT-2022-6722 · Synology · Synology Router Manager

Gaurav Baruah + 1 · Published 2022-12-22 · Updated 2023-05-25 · CVE-2023-32955

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Synology Router Manager versions prior to 1.2.5-8227-6 Synology Router Manager versions prior to 1.3.1-9346-3

Description The issue is related to improper neutralization of special elements used in an OS command, allowing man-in-the-middle attackers to execute arbitrary commands. This can be exploited by remote attackers to execute commands via unspecified vectors.

Recommendations For versions prior to 1.2.5-8227-6, update to version 1.2.5-8227-6 or later. For versions prior to 1.3.1-9346-3, update to version 1.3.1-9346-3 or later.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2023-03684

CVE-2023-32955

ZDI-23-662

Affected Products

Synology Router Manager

References · 6

• https://osv.dev/vulnerability/CVE-2023-32955 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-32955 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-23-662 · Security Note
• https://bdu.fstec.ru/vul/2023-03684 · Security Note
• https://synology.com/en-global/security/advisory/Synology_SA_22_25 · Vendor Advisory
• https://synology.com/en-global/security/advisory/SynologySA2225 · Note