Synology SRM Vulnerability Advisory: OS Command Injection & XSS (CVE-2024-53286-53288)

Critical Vulnerability Information Vulnerability Overview Vulnerability ID: Synology-SA-24:16 SRM Release Date: 2024-10-18 Update Date: 2025-07-23 Severity: Medium Status: Resolved Affected Products Product: SRM 1.3 Severity: Medium Fixed Version: Upgrade to 1.3.1-9346-11 or later Vulnerability Details 1. CVE-2024-53286 - Severity: Important - CVSS v3 Base Score: 7.2 - CVSS v3 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - CWE-78: Improper Neutralization of Special Elements in OS Commands (OS Command Injection) - Description: In the DDNS record feature of Synology Router Manager (SRM), a remote authenticated user could execute arbitrary code via unspecified vectors before upgrading to version 1.3.1-9346-11. 2. CVE-2024-53287 - Severity: Medium - CVSS v3 Base Score: 5.9 - CVSS v3 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L - CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) - Description: In the VPN settings feature of Synology Router Manager (SRM), a remote authenticated user could inject arbitrary web scripts or HTML via unspecified vectors before upgrading to version 1.3.1-9346-11. 3. CVE-2024-53288 - Severity: Medium - CVSS v3 Base Score: 5.9 - CVSS v3 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L - CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) - Description: In the NTP zone feature of Synology Router Manager (SRM), a remote authenticated user could inject arbitrary web scripts or HTML via unspecified vectors before upgrading to version 1.3.1-9346-11. Acknowledgments Only Hack In Cave team members: tr4ce (Jinho Ju), neko_hat (Dohwan Kim), twOn3 (Han Lee), Hc0wl (GangMin Kim) References CVE-2024-53286 CVE-2024-53287 CVE-2024-53288 Revision History

Goal Reached Thanks to every supporter — we hit 100%!

Synology SRM Vulnerability Advisory: OS Command Injection & XSS (CVE-2024-53286-53288)