The company published two new critical advisories in late December. One of them describes an internally discovered vulnerability affecting Synology VPN Plus Server, which turns routers into an advanced VPN server.
The security hole, tracked as CVE-2022-43931, is an out-of-bounds write issue in the remote desktop functionality of VPN Plus Server. It can allow a remote attacker to execute arbitrary commands.
The second advisory describes multiple vulnerabilities impacting the Synology Router Manager (SRM), the operating system that powers the firm’s routers. The flaws can be exploited for arbitrary command execution, denial-of-service (DoS) attacks, and reading arbitrary files.
The SRM advisory credits several people and companies for reporting the vulnerabilities, including Gaurav Baruah and Computest. They disclosed the issues through Trend Micro’s Zero Day Initiative (ZDI).
