CVE-2023-41738

HighCVSS 7.2

Published: 31/08/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.49%

71th percentile - higher than 71% of all known CVEs

Summary

CVE-2023-41738 describes an improper neutralization of special elements used in OS commands in Directory Domain Functionality in Synology Router Manager (SRM) before version 1.3.1-9346-6. This allows remote authenticated users to execute arbitrary commands via unspecified vectors.

Risk Assessment

The risk to the organization involves the potential for remote execution of arbitrary commands by authenticated users, which could lead to serious security breaches.

Recommendation

It is recommended to update Synology Router Manager to version 1.3.1-9346-6 or later to mitigate this vulnerability.

Other vulnerabilities in Synology Router Manager (SRM)

CVE-2023-41739Medium
CVE-2023-41739 in Synology Router Manager (SRM) before version 1.3.1-9346-6 has an uncontrolled resource consumption vulnerability that can be exploited by remote authenticated users to conduct denial-of-service attacks.

Original NVD description (English source)

Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in Directory Domain Functionality in Synology Router Manager (SRM) before 1.3.1-9346-6 allows remote authenticated users to execute arbitrary commands via unspecified vectors.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS