« Volver al listado

CVE-2024-53280

Estado: AnalizadaMedia (5.9)—

Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in network center policy route functionality in Synology Router Manager (SRM) before 1.3.1-9346-10 allows remote authenticated users with administrator privileges to read or write specific files containing non-sensitive information and conduct limited denial-of-service attacks by injecting arbitrary web script or HTML.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Synology — Router Manager

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-53280",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-53280",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-12-09T14:57:59.773190Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@synology.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5.9,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 3.7,
        "exploitabilityScore": 1.7
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5.9,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 3.7,
        "exploitabilityScore": 1.7
      }
    ]
  },
  "affected": [
    {
      "source": "security@synology.com",
      "affectedData": [
        {
          "vendor": "Synology",
          "product": "Synology Router Manager (SRM)",
          "versions": [
            {
              "status": "affected",
              "version": "1.3",
              "lessThan": "1.3.1-9346-10",
              "versionType": "semver"
            },
            {
              "status": "unknown",
              "version": "0",
              "lessThan": "1.3",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2024-12-09T04:15:04.650",
  "references": [
    {
      "url": "https://www.synology.com/en-global/security/advisory/Synology_SA_24_09",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@synology.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@synology.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in network center policy route functionality in Synology Router Manager (SRM) before 1.3.1-9346-10 allows remote authenticated users with administrator privileges to read or write specific files containing non-sensitive information and conduct limited denial-of-service attacks by injecting arbitrary web script or HTML."
    },
    {
      "lang": "es",
      "value": "La vulnerabilidad de neutralización incorrecta de la entrada durante la generación de páginas web ('Cross-site Scripting') en network center policy route functionality en Synology Router Manager (SRM)  anterior a 1.3.1-9346-10 permite que usuarios remotos autenticados con privilegios de administrador inyecten scripts web o HTML arbitrarios a través de vectores no especificados."
    }
  ],
  "lastModified": "2026-06-17T08:08:44.857",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:synology:router_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F8046DA6-36F6-4155-8594-8E7057396BFB",
              "versionEndExcluding": "1.3.1-9346",
              "versionStartIncluding": "1.3"
            },
            {
              "criteria": "cpe:2.3:o:synology:router_manager:1.3.1-9346:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1516A124-FB02-4ADA-BCB6-27F0F1170A11"
            },
            {
              "criteria": "cpe:2.3:o:synology:router_manager:1.3.1-9346:update1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BD983E13-D56A-4E76-9689-0F1AE99CEC7E"
            },
            {
              "criteria": "cpe:2.3:o:synology:router_manager:1.3.1-9346:update2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7C642E1B-1E10-444E-9243-7A7E8ECBD17D"
            },
            {
              "criteria": "cpe:2.3:o:synology:router_manager:1.3.1-9346:update3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B7544B4B-5BB7-4D58-8943-98DACC17E5F3"
            },
            {
              "criteria": "cpe:2.3:o:synology:router_manager:1.3.1-9346:update4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5A7269FD-9F1D-4CA3-A8F6-3A13C967FBD7"
            },
            {
              "criteria": "cpe:2.3:o:synology:router_manager:1.3.1-9346:update5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "52005D46-FFB0-44DF-9583-7EB436F2CDF0"
            },
            {
              "criteria": "cpe:2.3:o:synology:router_manager:1.3.1-9346:update6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E50F7D87-1D71-4AA7-A6C8-B15744521D23"
            },
            {
              "criteria": "cpe:2.3:o:synology:router_manager:1.3.1-9346:update7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CFE129E2-9243-4DB3-9D2F-9E0F886ECCC6"
            },
            {
              "criteria": "cpe:2.3:o:synology:router_manager:1.3.1-9346:update8:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "185CD5A8-1115-40AF-91DD-E0065E1ACD7A"
            },
            {
              "criteria": "cpe:2.3:o:synology:router_manager:1.3.1-9346:update9:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0162C158-37F0-401F-9027-C067335C0A28"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@synology.com"
}