Synology Router Manager (SRM) Vulnerability Allows Man-in-the-Middle Attacks on Sensitive Intranet Resources

CVE-2024-39347
5.9MEDIUM

Key Information

Vendor
Synology
Status
Synology Router Manager (srm)
Vendor
CVE Published:
28 June 2024

Summary

Incorrect default permissions vulnerability in firewall functionality in Synology Router Manager (SRM) before 1.2.5-8227-11 and 1.3.1-9346-8 allows man-in-the-middle attackers to access highly sensitive intranet resources via unspecified vectors.

Affected Version(s)

Synology Router Manager (SRM) <= 1.3

Synology Router Manager (SRM) < 1.3.1-9346-8

Synology Router Manager (SRM) < 1.2.5-8227-11

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published.

  • Vulnerability Reserved.

Collectors

NVD DatabaseMitre Database

Credit

Tri and Bien Pham (@bienpnn) from Team Orca of Sea Security working with Trend Micro Zero Day Initiative
.