PT-2024-9668 · Synology · Synology Router Manager

Published 2024-09-09 · Updated 2025-08-01 · CVE-2024-53281

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Synology Router Manager versions prior to 1.3.1-9346-10

Description The issue is related to improper neutralization of input during web page generation, also known as Cross-site Scripting (XSS), in the Network WOL functionality. This could allow a remote attacker to inject arbitrary web script or HTML, potentially leading to security breaches. The vulnerability is exploited by injecting malicious scripts via unspecified vectors, affecting the structure of web pages.

Recommendations For versions prior to 1.3.1-9346-10, update to version 1.3.1-9346-10 or later to resolve the issue. As a temporary workaround, consider restricting access to the Network WOL functionality until a patch is applied. Avoid using the vulnerable Network WOL feature in Synology Router Manager until the update is installed.

Fix

DoS

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2024-11380

CVE-2024-53281

Affected Products

Synology Router Manager

References · 9

• https://bdu.fstec.ru/vul/2024-11380 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-53281 · Security Note
• https://synology.com/en-global/security/advisory/Synology_SA_24_09 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-53281 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1865992748462956703 · Twitter Post
• https://t.me/cveNotify/130508 · Telegram Post
• https://t.me/cvenotify/103499 · Telegram Post
• https://twitter.com/CVEnew/status/1865968461262028853 · Twitter Post
• https://t.me/cvedetector/12358 · Telegram Post