PT-2022-7194 · Synology · Synology Router Manager

Gaurav Baruah + 1 · Published 2022-12-22 · Updated 2023-01-11 · CVE-2023-0077

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Synology Router Manager versions prior to 1.2.5-8227-6 Synology Router Manager versions prior to 1.3.1-9346-3

Description The issue is related to an integer overflow or wraparound vulnerability in the CGI component of Synology Router Manager. This vulnerability can be exploited by a remote attacker to impact the confidentiality, integrity, and availability of protected information. The vulnerability allows remote attackers to overflow buffers via unspecified vectors.

Recommendations For versions prior to 1.2.5-8227-6, update to version 1.2.5-8227-6 or later. For versions prior to 1.3.1-9346-3, update to version 1.3.1-9346-3 or later.

Fix

Integer Overflow

Weakness Enumeration

CWE-190

CWE-189

Related Identifiers

BDU:2023-09008

CVE-2023-0077

Affected Products

Synology Router Manager

References · 5

• https://osv.dev/vulnerability/CVE-2023-0077 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-0077 · Security Note
• https://synology.com/en-global/security/advisory/Synology_SA_22_25 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-09008 · Security Note
• https://t.me/cibsecurity/55930 · Telegram Post