CVE-2024-53286 | THREATINT

Description

Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in DDNS Record functionality in Synology Router Manager (SRM) before 1.3.1-9346-11 allows remote authenticated users with administrator privileges to execute arbitrary code via unspecified vectors.

Reserved 2024-11-20 | Published 2025-07-23 | Updated 2025-07-23 | Assigner synology

HIGH: 7.2CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Problem types

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Product status

Default status

affected

1.3 before 1.3.1-9346-11

affected

Any version before 1.3

unknown

Credits

Only Hack in Cave (tr4ce(Jinho Ju), neko_hat(Dohwan Kim), tw0n3(Han Lee), Hc0wl(GangMin Kim)) (https://github.com/Team-OHiC) finder

References

www.synology.com/...obal/security/advisory/Synology_SA_24_16 (Synology-SA-24:16 SRM) vendor-advisory

cve.org (CVE-2024-53286)

nvd.nist.gov (CVE-2024-53286)

Download JSON