CVE-2023-32955

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in DHCP Client Functionality in Synology Router Manager (SRM) before 1.2.5-8227-6 and 1.3.1-9346-3 allows man-in-the-middle attackers to execute arbitrary commands via unspecified vectors.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
Synology	Synology Router Manager (SRM)	>= 1.2, < 1.2.5-8227-6; >= 1.3, < 1.3.1-9346-3

References

https://www.synology.com/en-global/security/advisory/Synology_SA_22_25Vendor Advisory
https://www.synology.com/en-global/security/advisory/Synology_SA_22_25Vendor Advisory

Timeline

Published: May 16, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-329569.8Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in CGI component in Synology Router CVE-2023-329574.8Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Dazzlersoft Team Members Showcase plugin <= 1.3.4 versions.CVE-2023-329584.8Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Nose Graze Novelist plugin <= 1.2.0 versions.CVE-2023-329594.3Missing Authorization vulnerability in Sparkle WP MetroStore metrostore allows Exploiting Incorrectly Configured Access Control Security Lev CVE-2023-329606.1Cross-Site Request Forgery (CSRF) vulnerability in UpdraftPlus.Com, DavidAnderson UpdraftPlus WordPress Backup Plugin <= 1.23.3 versions lea CVE-2023-329616.1Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Katie Seaborn Zotpress plugin <= 7.3.3 versions.CVE-2023-329624.8Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in HasTheme WishSuite – Wishlist for WooCommerce plugin <= 1.3.4 versions.CVE-2023-329635.3Missing Authorization vulnerability in a3rev Software WooCommerce Predictive Search allows Exploiting Incorrectly Configured Access Control CVE-2023-329648.8Cross-Site Request Forgery (CSRF) vulnerability in Made with Fuel Better Notifications for WP plugin <= 1.9.2 versions.CVE-2023-329656.1Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in CRUDLab Jazz Popups plugin <= 1.8.7 versions.CVE-2023-329666.1Cross-Site Request Forgery (CSRF) vulnerability in CRUDLab Jazz Popups leads to Stored XSS.This issue affects Jazz Popups: from n/a through CVE-2023-329676.5An incorrect authorization vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability