Cross-site Scripting Vulnerability in Synology Router Manager
CVE-2024-53288

5.9MEDIUM

Key Information:

Vendor

Synology
Status
Synology Router Manager (srm)
Vendor
CVE Published:
23 July 2025

What is CVE-2024-53288?

A vulnerability in the NTP Region functionality of Synology Router Manager allows remote authenticated users with administrative privileges to inject arbitrary web scripts or HTML content. This flaw arises from improper handling of user input during the web page generation process, opening doors for potential exploitation and attacks on the web application.

Affected Version(s)

Synology Router Manager (SRM) 1.3

Synology Router Manager (SRM) 1.3 < 1.3.1-9346-11

References

https://www.synology.com/en-global/security/advisory/Syno...
vendor-advisory

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Only Hack in Cave (tr4ce(Jinho Ju), neko_hat(Dohwan Kim), tw0n3(Han Lee), Hc0wl(GangMin Kim)) (https://github.com/Team-OHiC)
.