PT-2023-2773 · Synology · Synology Router Manager

Orange Tsai · Published 2023-05-16 · Updated 2023-05-25 · CVE-2023-32956

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Synology Router Manager versions prior to 1.2.5-8227-6 Synology Router Manager versions prior to 1.3.1-9346-3

Description The issue is related to an OS command injection vulnerability in the CGI component of Synology Router Manager. This vulnerability allows a remote attacker to execute arbitrary code.

Recommendations For versions prior to 1.2.5-8227-6, update to version 1.2.5-8227-6 or later. For versions prior to 1.3.1-9346-3, update to version 1.3.1-9346-3 or later.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2023-02663

CVE-2023-32956

Affected Products

Synology Router Manager

References · 5

• https://osv.dev/vulnerability/CVE-2023-32956 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-32956 · Security Note
• https://synology.com/en-global/security/advisory/Synology_SA_22_25 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-02663 · Security Note
• https://t.me/pentestingnews/35993 · Telegram Post