CVE-2024-53283 is a Cross-site Scripting (XSS) vulnerability affecting Synology Router Manager (SRM) versions prior to 1.3.1-9346-10, specifically within the Router Port Forward functionality. This medium-severity vulnerability (CVSS 5.9) requires administrator privileges and user interaction, allowing remote authenticated attackers to inject arbitrary web script or HTML. Successful exploitation could lead to reading/writing non-sensitive files and limited denial-of-service attacks. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 1.3, < 1.3.1-9346CPE matchmatch criteria | cpe:2.3:o:synology:router_manager:*:*:*:*:*:*:*:* | ||
1.3.1-9346CPE matchmatch criteria | cpe:2.3:o:synology:router_manager:1.3.1-9346:-:*:*:*:*:*:* | ||
1.3.1-9346CPE matchmatch criteria | cpe:2.3:o:synology:router_manager:1.3.1-9346:update1:*:*:*:*:*:* | ||
1.3.1-9346CPE matchmatch criteria | cpe:2.3:o:synology:router_manager:1.3.1-9346:update2:*:*:*:*:*:* | ||
1.3.1-9346CPE matchmatch criteria | cpe:2.3:o:synology:router_manager:1.3.1-9346:update3:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.