CVE-2020-27651

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

Synology Router Manager (SRM) before 1.2.4-8081 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-614 CWE-311

Affected software

Vendor	Product	Versions
Synology	Synology Router Manager (SRM)	>= unspecified, < 1.2.4-8081

References

https://www.synology.com/security/advisory/Synology_SA_20_14Vendor Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1059Exploit, Third Party Advisory
https://www.synology.com/security/advisory/Synology_SA_20_14Vendor Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1059Exploit, Third Party Advisory

Timeline

Published: Oct 29, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-276528.3Algorithm downgrade vulnerability in QuickConnect in Synology DiskStation Manager (DSM) before 6.2.3-25426-2 allows man-in-the-middle attack CVE-2020-276538.3Algorithm downgrade vulnerability in QuickConnect in Synology Router Manager (SRM) before 1.2.4-8081 allows man-in-the-middle attackers to s CVE-2020-276549.8Improper access control vulnerability in lbd in Synology Router Manager (SRM) before 1.2.4-8081 allows remote attackers to execute arbitrary CVE-2020-2765510.0Improper access control vulnerability in Synology Router Manager (SRM) before 1.2.4-8081 allows remote attackers to access restricted resour CVE-2020-276563.7Cleartext transmission of sensitive information vulnerability in DDNS in Synology DiskStation Manager (DSM) before 6.2.3-25426-2 allows man-CVE-2020-276575.9Cleartext transmission of sensitive information vulnerability in DDNS in Synology Router Manager (SRM) before 1.2.4-8081 allows man-in-the-m CVE-2020-276586.1Synology Router Manager (SRM) before 1.2.4-8081 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which make CVE-2020-276594.8Multiple cross-site scripting (XSS) vulnerabilities in Synology SafeAccess before 1.2.3-0234 allow remote attackers to inject arbitrary web CVE-2020-27665.3Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected a CVE-2020-276609.8SQL injection vulnerability in request.cgi in Synology SafeAccess before 1.2.3-0234 allows remote attackers to execute arbitrary SQL command CVE-2020-276616.5A divide-by-zero issue was found in dwc2_handle_packet in hw/usb/hcd-dwc2.c in the hcd-dwc2 USB host controller emulation of QEMU. A malicio CVE-2020-276624.3In GLPI before 9.5.3, ajax/comments.php has an Insecure Direct Object Reference (IDOR) vulnerability that allows an attacker to read data fr