A critical OS command injection vulnerability in Synology Router Manager allows authenticated administrators to achieve remote code execution, posing a significant risk to network infrastructure.

This is an OS command injection flaw (CWE-78) located in the DDNS Record functionality. It requires the attacker to be a remote authenticated user with administrator privileges to trigger arbitrary code execution.

Successful exploitation of this vulnerability allows an attacker with administrative access to execute arbitrary commands on the underlying operating system. This could lead to a full compromise of the router device, enabling persistent access to the internal network, data interception, or the disruption of critical network connectivity. With a CVSS score of 7.2, the high impact on confidentiality, integrity, and availability necessitates prompt remediation.

Immediate Action: Update Synology Router Manager to version 1.3.1-9346-11 or later as specified in the official Synology security advisory.

Proactive Monitoring: Review administrative access logs for unusual activity or unauthorized configuration changes within the DDNS settings.

Compensating Controls: Restrict administrative access to the management interface to trusted internal IP addresses only, effectively reducing the attack surface for remote exploitation.

Public Exploit Available: Unknown

Given the potential for complete device takeover, administrators should prioritize updating Synology Router Manager firmware to the patched version. Ensuring that only authorized personnel have administrative credentials is a critical secondary defense to prevent the exploitation of this and similar vulnerabilities.