CVE-2023-41738

EPSS 0.76%
Published 31.08.2023 10:15:08
Last modified 21.11.2024 08:21:35
Source security@synology.com
Teams watchlist Login
Open Login

Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in Directory Domain Functionality in Synology Router Manager (SRM) before 1.3.1-9346-6 allows remote authenticated users to execute arbitrary commands via unspecified vectors.

Affected products Warnungen 0 Metrics 3 CWE 0 References 4

Data is provided by the National Vulnerability Database (NVD)

Synology ≫ Router Manager Version < 1.3.1-9346-6

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.76%	0.725

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	8.8	2.8	5.9	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
security@synology.com	7.2	1.2	5.9	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

https://www.synology.com/en-global/security/advisory/Synology_SA_23_10

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2023-41738

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2023-41738

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2023-41738

EUVD