CVE-2025-10466 Overview
CVE-2025-10466 is a Cross-Site Scripting (XSS) vulnerability in Synology Safe Access affecting Synology Router Manager (SRM). The flaw stems from improper neutralization of input during web page generation [CWE-79]. Remote authenticated users with administrator privileges can leverage the vulnerability to read or write specific files containing non-sensitive information. Attackers can also trigger a limited denial-of-service condition within SRM. Synology addressed the issue in Safe Access version 1.3.1-0329.
Critical Impact
Authenticated administrators can exploit injected script in the Safe Access web interface to access non-sensitive file contents and cause limited service disruption on Synology SRM devices.
Affected Products
- Synology Safe Access versions before 1.3.1-0329
- Synology Router Manager (SRM) deployments running vulnerable Safe Access
- Synology routers using the Safe Access package for network security policies
Discovery Timeline
- 2026-05-27 - CVE-2025-10466 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2025-10466
Vulnerability Analysis
The vulnerability resides in the Safe Access component of Synology Router Manager. Safe Access generates web page content that includes user-controlled input without proper output encoding or sanitization. An attacker who already holds administrator privileges can inject malicious script content into fields rendered by the management interface. When another administrator views the affected pages, the injected payload executes in their browser session.
The Common Weakness Enumeration classifies this as [CWE-79], the canonical identifier for Cross-Site Scripting flaws. The injected script runs with the privileges of the viewing user inside the SRM web context. According to Synology's advisory, exploitation enables limited file read or write actions on data classified as non-sensitive. Exploitation also permits limited denial-of-service against SRM functionality.
Root Cause
The root cause is missing input neutralization in the web page generation logic of Safe Access. User-supplied data flows from input fields to HTML output without contextual escaping. The browser interprets attacker-controlled markup as executable script. This is a classic stored or reflected XSS pattern in an administrative web application.
Attack Vector
The attack vector is network-based but requires high privileges and user interaction. An administrator must first authenticate to inject the payload, and a second administrator must visit the affected page to trigger execution. The scope is changed because script executes in the SRM browser context rather than the original Safe Access component. Confidentiality, integrity, and availability impacts are all rated low.
No public proof-of-concept exploit is available. The EPSS score is 0.035%, indicating low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2025-10466
Indicators of Compromise
- Unexpected <script> tags, event handlers, or encoded HTML payloads stored in Safe Access configuration fields
- Administrator browser sessions executing JavaScript that initiates file read or write requests to SRM endpoints
- Anomalous outbound requests from administrative browsers to attacker-controlled domains following Safe Access page loads
- Unexplained transient SRM service interruptions correlated with administrator activity in Safe Access
Detection Strategies
- Inspect Safe Access policy and configuration fields for HTML or JavaScript content that should not be present in administrative input
- Review SRM web server logs for requests containing encoded XSS payloads such as %3Cscript%3E, onerror=, or javascript: schemes
- Correlate administrator authentication events with file modification activity in Safe Access logs to surface scripted actions
Monitoring Recommendations
- Enable verbose logging for administrative actions on the Synology SRM device and forward events to a centralized SIEM
- Monitor for changes to Safe Access policies performed outside of approved change windows
- Alert on multiple administrator sessions originating from disparate IP addresses within short timeframes
How to Mitigate CVE-2025-10466
Immediate Actions Required
- Upgrade Synology Safe Access to version 1.3.1-0329 or later through the SRM Package Center
- Restrict administrative access to the SRM interface to trusted management networks only
- Audit existing Safe Access configurations and remove any unexpected HTML or script content from policy fields
- Review the administrator account roster and revoke privileges that are no longer required
Patch Information
Synology released a fix in Safe Access version 1.3.1-0329. Administrators should apply the update through the SRM Package Center. Refer to the Synology Security Advisory SA-25-11 for complete remediation guidance and version details.
Workarounds
- Limit the number of accounts with administrator privileges on SRM to reduce the exploitable attack surface
- Require administrators to access SRM only from dedicated, hardened workstations to limit cross-session script execution
- Enable two-factor authentication for all SRM administrator accounts to raise the bar for account compromise
# Verify the installed Safe Access version on Synology SRM
# Navigate to: Package Center > Installed > Safe Access
# Confirm version is 1.3.1-0329 or later
# Restrict admin interface to trusted management subnet
# Control Panel > Security > Firewall > Edit Rules
# Allow: source=10.0.0.0/24 dest_port=8001 proto=tcp action=allow
# Deny: source=any dest_port=8001 proto=tcp action=deny
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
