CVE-2024-53286 — OS Command Injection in Synology Router Manager

CWE-78 — OS Command Injection3 documents3 sources

Severity

7.2HIGHNVD

EPSS

0.5%

top 32.29%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Synology Router Manager Synology Router Manager

Timeline

PublishedJul 23

Description

Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in DDNS Record functionality in Synology Router Manager (SRM) before 1.3.1-9346-11 allows remote authenticated users with administrator privileges to execute arbitrary code via unspecified vectors.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 1.2 | Impact: 5.9

Affected Packages2 packages

▶NVDsynology/router_manager1.3 — 1.3.1-9346+1

▶CVEListV5synology/synology_router_manager1.3 — 1.3.1-9346-11

🔴Vulnerability Details

GHSA

GHSA-wv44-h7fg-jf4w: Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in DDNS Record functionality in Synology Rout↗2025-07-23

▶

CVEList

CVE-2024-53286: Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in DDNS Record functionality in Synology Rout↗2025-07-23

▶