CVE-2024-11398: Synology Router Manager Path Traversal

CVE-2024-11398 Overview

CVE-2024-11398 is a path traversal vulnerability [CWE-22] affecting the one-time password (OTP) reset functionality in Synology Router Manager (SRM). The flaw allows remote authenticated users to delete arbitrary files on affected routers through unspecified attack vectors. Synology tracks this issue in advisory SA-24-03 and has released a fix in SRM version 1.3.1-9346-9.

The vulnerability affects the confidentiality of router configurations by enabling deletion of files outside the intended directory scope. Successful exploitation can impact both integrity and availability of the router, potentially disrupting network services for downstream users.

Critical Impact
Authenticated attackers can delete arbitrary files on Synology routers, causing service disruption and possible denial of network access for connected clients.

Affected Products

Synology Router Manager (SRM) versions before 1.3.1-9346-9
SRM 1.3.1-9346 base release and updates 1 through 8
Synology router hardware running vulnerable SRM firmware

Discovery Timeline

2024-12-04 - CVE-2024-11398 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-11398

Vulnerability Analysis

The vulnerability resides in the OTP reset functionality of Synology Router Manager. The affected code fails to properly limit pathnames to a restricted directory when handling reset operations. An authenticated attacker can supply crafted path input containing directory traversal sequences such as ../ to reference files outside the expected reset scope.

Because the OTP reset workflow performs file deletion operations, the traversal condition translates into arbitrary file deletion on the router file system. The attacker requires only low-privilege authenticated access, and no user interaction is needed to trigger the flaw. Deletion of critical configuration or system files can render the router unstable or unusable.

Root Cause

The root cause is improper input validation on file path parameters processed by the OTP reset handler. The application accepts a filename or path value from an authenticated request and passes it to a file deletion routine without canonicalization or restriction to an allowlisted directory. This aligns with CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

Attack Vector

Exploitation occurs over the network against the SRM web management interface. The attacker must first authenticate to the router with any valid account that can invoke the OTP reset function. Once authenticated, the attacker submits a request containing directory traversal sequences targeting arbitrary files on the underlying operating system.

Synology has not published proof-of-concept code, and the specific vectors remain undisclosed in the advisory. See the Synology Security Advisory SA-24-03 for vendor-supplied details.

Detection Methods for CVE-2024-11398

Indicators of Compromise

Unexpected deletion of system, configuration, or log files on the SRM filesystem
HTTP requests to OTP reset endpoints containing .., %2e%2e, or encoded traversal sequences
Router service instability, missing services, or configuration reverting to defaults without administrator action
Authentication logs showing OTP reset activity from unfamiliar accounts or IP addresses

Detection Strategies

Inspect SRM web server access logs for requests to OTP-related endpoints containing traversal patterns
Correlate authenticated administrative actions with subsequent file deletion events on the router
Baseline expected file inventory on SRM devices and alert on deviations

Monitoring Recommendations

Forward SRM access and authentication logs to a centralized log platform for retention and analysis
Alert on repeated failed authentication attempts followed by successful logins to router management
Monitor router availability and configuration integrity through management tooling

How to Mitigate CVE-2024-11398

Immediate Actions Required

Upgrade Synology Router Manager to version 1.3.1-9346-9 or later on all affected devices
Restrict SRM administrative access to trusted management networks only
Audit existing user accounts on the router and remove unused or unnecessary accounts
Rotate credentials for all SRM accounts after patching to invalidate any prior compromise

Patch Information

Synology has released SRM 1.3.1-9346-9 to address CVE-2024-11398. Administrators should apply the update through the SRM control panel or download it from the Synology Download Center. Details are documented in the Synology Security Advisory SA-24-03.

Workarounds

Disable remote administrative access to the router until the patch is applied
Limit OTP reset functionality to users with a demonstrated operational need
Place router management interfaces behind a VPN or firewall access control list

bash

# Verify installed SRM version via the web UI or vendor tooling
# Target version: 1.3.1-9346-9 or later
# Restrict management access example (upstream firewall):
#   allow tcp from <mgmt_subnet> to <router_ip> port 8001
#   deny tcp from any to <router_ip> port 8001