« Volver al listado

CVE-2024-53285

Estado: AnalizadaMedia (5.9)—

Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in DDNS Record functionality in Synology Router Manager (SRM) before 1.3.1-9346-10 allows remote authenticated users with administrator privileges to read or write specific files containing non-sensitive information and conduct limited denial-of-service attacks by injecting arbitrary web script or HTML.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Synology — Router Manager

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-53285",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-53285",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-12-09T14:57:59.773190Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@synology.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5.9,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 3.7,
        "exploitabilityScore": 1.7
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5.9,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 3.7,
        "exploitabilityScore": 1.7
      }
    ]
  },
  "affected": [
    {
      "source": "security@synology.com",
      "affectedData": [
        {
          "vendor": "Synology",
          "product": "Synology Router Manager (SRM)",
          "versions": [
            {
              "status": "affected",
              "version": "1.3",
              "lessThan": "1.3.1-9346-10",
              "versionType": "semver"
            },
            {
              "status": "unknown",
              "version": "0",
              "lessThan": "1.3",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "affected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:synology:router_manager:*:*:*:*:*:*:*:*"
          ],
          "vendor": "synology",
          "product": "router_manager",
          "versions": [
            {
              "status": "unknown",
              "version": "0",
              "lessThan": "1.3",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "1.3",
              "lessThan": "1.3.1-9346-10",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:a:synology:router_manager:*:*:*:*:*:*:*:*"
          ],
          "vendor": "synology",
          "product": "router_manager",
          "versions": [
            {
              "status": "unknown",
              "version": "0",
              "lessThan": "1.3",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "1.3",
              "lessThan": "1.3.1-9346-10",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-12-09T04:15:05.387",
  "references": [
    {
      "url": "https://www.synology.com/en-global/security/advisory/Synology_SA_24_09",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@synology.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@synology.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in DDNS Record functionality in Synology Router Manager (SRM) before 1.3.1-9346-10 allows remote authenticated users with administrator privileges to read or write specific files containing non-sensitive information and conduct limited denial-of-service attacks by injecting arbitrary web script or HTML."
    },
    {
      "lang": "es",
      "value": "La vulnerabilidad de neutralización incorrecta de la entrada durante la generación de páginas web ('Cross-site Scripting') en la funcionalidad de registro DDNS en Synology Router Manager (SRM) anterior a 1.3.1-9346-10 permite a usuarios remotos autenticados con privilegios de administrador inyectar HTML o scripts web arbitrarios a través de vectores no especificados."
    }
  ],
  "lastModified": "2026-06-17T08:08:45.443",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:synology:router_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F8046DA6-36F6-4155-8594-8E7057396BFB",
              "versionEndExcluding": "1.3.1-9346",
              "versionStartIncluding": "1.3"
            },
            {
              "criteria": "cpe:2.3:o:synology:router_manager:1.3.1-9346:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1516A124-FB02-4ADA-BCB6-27F0F1170A11"
            },
            {
              "criteria": "cpe:2.3:o:synology:router_manager:1.3.1-9346:update1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BD983E13-D56A-4E76-9689-0F1AE99CEC7E"
            },
            {
              "criteria": "cpe:2.3:o:synology:router_manager:1.3.1-9346:update2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7C642E1B-1E10-444E-9243-7A7E8ECBD17D"
            },
            {
              "criteria": "cpe:2.3:o:synology:router_manager:1.3.1-9346:update3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B7544B4B-5BB7-4D58-8943-98DACC17E5F3"
            },
            {
              "criteria": "cpe:2.3:o:synology:router_manager:1.3.1-9346:update4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5A7269FD-9F1D-4CA3-A8F6-3A13C967FBD7"
            },
            {
              "criteria": "cpe:2.3:o:synology:router_manager:1.3.1-9346:update5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "52005D46-FFB0-44DF-9583-7EB436F2CDF0"
            },
            {
              "criteria": "cpe:2.3:o:synology:router_manager:1.3.1-9346:update6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E50F7D87-1D71-4AA7-A6C8-B15744521D23"
            },
            {
              "criteria": "cpe:2.3:o:synology:router_manager:1.3.1-9346:update7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CFE129E2-9243-4DB3-9D2F-9E0F886ECCC6"
            },
            {
              "criteria": "cpe:2.3:o:synology:router_manager:1.3.1-9346:update8:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "185CD5A8-1115-40AF-91DD-E0065E1ACD7A"
            },
            {
              "criteria": "cpe:2.3:o:synology:router_manager:1.3.1-9346:update9:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0162C158-37F0-401F-9027-C067335C0A28"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@synology.com"
}