CVE-2020-27651

PoC —

CVSS 3.1

8.1 high

EPSS

<1%p54

Published

Oct 29, 2020 (Oct 29, 2020)

Modified

Jun 17, 2026

Description

Synology Router Manager (SRM) before 1.2.4-8081 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session.

Vendors: synology
Products: router manager
Weakness: CWE-614, CWE-311
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.8%)

In the news0 stories

No ingested article mentions this CVE yet.