CVE-2024-53285 — Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in DDNS Record functionality in Synology Router Manager (SRM) before 1.3.1-9346-10 allows remote authenticated users with administrator privileges to read or write specific files containing non-sensitive information and conduct limited denial-of-service attacks by injecting arbitrary web script or HTML

Back Back to CVE browser

MEDIUM

Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in DDNS Record functionality in Synology Router Manager (SRM) before 1.3.1-9346-10 allows remote authenticated users with administrator privileges to read or write specific files containing non-sensitive information and conduct limited denial-of-service attacks by injecting arbitrary web script or HTML

Published Dec 9, 2024

5.9

MEDIUM

CVSS 3.1

EPSS 0.27%

Description

Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in DDNS Record functionality in Synology Router Manager (SRM) before 1.3.1-9346-10 allows remote authenticated users with administrator privileges to read or write specific files containing non-sensitive information and conduct limited denial-of-service attacks by injecting arbitrary web script or HTML.

Affected products

Vendor Synology Product Synology Router Manager (SRM) Default
affected
- Version
  1.3
  Status
  affected
  Constraints
  <1.3.1-9346-10

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Synology

Synology Router Manager (SRM)

affected

Version	Status	Constraints
1.3	affected	<1.3.1-9346-10

Vendor Synology Product Router Manager Default
n/a
- Version
  1.3
  Status
  affected
  Constraints
  <1.3.1-9346-10

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Synology

Router Manager

n/a

Version	Status	Constraints
1.3	affected	<1.3.1-9346-10

Remediation

No remediation recorded yet.

Metrics

0.27% 0.00271

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.00271

Score over time

2024–2026

EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v3
EPSS v4
EPSS v5

Table of values (5 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	0.27% (0.00271)	17.66th	v5 (v2026.06.15)
Jun 15, 2026	0.26% (0.00255)	16.63th	v5 (v2026.06.15)
Mar 17, 2025	0.10% (0.00095)	24.42th	v4 (v2025.03.14)
Dec 12, 2024	0.04% (0.00043)	10.81th	v3 (v2023.03.01)
Dec 10, 2024	0.04% (0.00043)	10.70th	v3 (v2023.03.01)