CVE-2023-32956 — OS Command Injection in Synology Router Manager

CWE-78 — OS Command Injection3 documents3 sources

Severity

9.8CRITICALNVD

EPSS

3.6%

top 12.17%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Synology Router Manager Synology Router Manager

Timeline

PublishedMay 16

Description

Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in CGI component in Synology Router Manager (SRM) before 1.2.5-8227-6 and 1.3.1-9346-3 allows remote attackers to execute arbitrary code via unspecified vectors.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

▶NVDsynology/router_manager1.2 — 1.2.5-8227-6+1

▶CVEListV5synology/synology_router_manager1.3 — 1.3.1-9346-3+1

🔴Vulnerability Details

GHSA

GHSA-44px-68jg-57xp: Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in CGI component in Synology Router Manager (↗2023-05-16

▶

CVEList

CVE-2023-32956: Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in CGI component in Synology Router Manager (↗2023-05-16

▶