CVE-2023-41740

MediumCVSS 5.3

Published: 31/08/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.76%

50th percentile - higher than 50% of all known CVEs

Summary

CVE-2023-41740 describes an improper limitation of a pathname to a restricted directory in the cgi component of Synology Router Manager (SRM) before version 1.3.1-9346-6. This allows remote attackers to read specific files via unspecified vectors.

Risk Assessment

Organizations may be exposed to unauthorized access to sensitive data, potentially leading to information leaks or further attacks on the system.

Recommendation

It is recommended to update Synology Router Manager to version 1.3.1-9346-6 or later to mitigate this vulnerability.

Original NVD description (English source)

Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in cgi component in Synology Router Manager (SRM) before 1.3.1-9346-6 allows remote attackers to read specific files via unspecified vectors.