Synology Radius Server vulnerabilities

5 CVEs affecting Synology Radius Server, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-13987, published 2025-08-29.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-9494, published 2019-04-17. Medium severity, CVSS 5.9. EPSS: 3.9% chance of exploitation in the next 30 days. The implementations of SAE in hostapd and wpa_supplicant are vulnerable to side channel attacks as a result of observable timing differences and cache access patterns. An attacker may be able to gain…
CVE-2019-9495, published 2019-04-17. Low severity, CVSS 3.7. EPSS: 3.5% chance of exploitation in the next 30 days. The implementations of EAP-PWD in hostapd and wpa_supplicant are vulnerable to side-channel attacks as a result of cache access patterns. All versions of hostapd and wpa_supplicant with EAP-PWD…
CVE-2019-9499, published 2019-04-17. High severity, CVSS 8.1. EPSS: 2.2% chance of exploitation in the next 30 days. The implementations of EAP-PWD in wpa_supplicant EAP Peer, when built against a crypto library missing explicit validation on imported elements, do not validate the scalar and element values in…
CVE-2019-9498, published 2019-04-17. High severity, CVSS 8.1. EPSS: 2.2% chance of exploitation in the next 30 days. The implementations of EAP-PWD in hostapd EAP Server, when built against a crypto library missing explicit validation on imported elements, do not validate the scalar and element values in…
CVE-2024-13987, published 2025-08-29. Medium severity, CVSS 5.9. EPSS: 0.3% chance of exploitation in the next 30 days. Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Synology RADIUS Server allows remote authenticated users with administrator privileges to read or…