CVE-2022-43932: Synology Router Manager

High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days.

Improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in CGI component in Synology Router Manager (SRM) before 1.2.5-8227-6 and 1.3.1-9346-3 allows remote attackers to read arbitrary files via unspecified vectors.

Affected products

• Synology Router Manager: from 1.2, before 1.2.5-8227-6 (fixed in 1.2.5-8227-6); from 1.3, before 1.3.1-9346-3 (fixed in 1.3.1-9346-3)

Published 2023-01-05. Last modified 2026-06-17.