Synology Safe Access EUVD-2025-209953

Exploitation requires an active administrator-level authenticated session on the Synology SRM interface (PR:H per CVSS), meaning the attacker must already possess or compromise a full admin account - not a standard user. Additionally, a second user interaction is required (UI:R): another administrator must load or interact with content containing the injected payload. The vulnerability is limited to Synology devices running SRM with the Safe Access package installed and at a version prior to 1.3.1-0329. Limiting factors: administrator privilege prerequisite is a high bar for external attackers; UI:R prevents fully autonomous exploitation; impact is restricted to non-sensitive file read/write and limited DoS within SRM, ruling out credential theft or remote code execution. Default SRM deployments with a single administrator account reduce the realistic multi-admin interaction surface significantly.

The composite risk picture here is low. CVSS 5.9 Medium reflects the Scope:Changed escalation and network vector, but is significantly constrained by the PR:H requirement - only existing administrator accounts can trigger this vulnerability. User interaction (UI:R) adds a further barrier, meaning a second administrator would need to load attacker-crafted content. EPSS at 0.03% (11th percentile) confirms this is well below typical exploitation thresholds, and SSVC signals no automated exploitation path (Automatable: no) and only partial technical impact. CISA KEV does not list this CVE, and no public proof-of-concept has been reported. The described impact - reading or writing non-sensitive files and limited DoS within SRM - is narrow even if exploitation succeeds. Overall this is a low-priority patching item for most organizations: real-world harm requires a compromised or rogue admin account targeting another admin, not an external attacker against default configurations.

An authenticated administrator on a vulnerable SRM deployment injects a malicious script payload into a Safe Access configuration field that is later rendered in the SRM interface for another administrator. When the second admin loads the affected page (UI:R), the injected script executes in the SRM web context and can read or write specific non-sensitive files accessible to the SRM application, or trigger limited service disruption. No public proof-of-concept exists at time of analysis, and successful exploitation requires control of an administrator account plus a second-admin interaction vector.