This vulnerability in Synology Safe Access arises from improper input neutralization during web page generation, leading to cross-site scripting (XSS). It affects versions before 1.3.1-0329 and requires remote authenticated administrator access. Exploitation can result in reading or writing specific non-sensitive files or limited denial-of-service conditions within SRM. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, user interaction required, and impacts confidentiality, integrity, and availability to a limited extent.

The vulnerability allows remote authenticated administrators to perform cross-site scripting attacks that can read or write certain non-sensitive files and cause limited denial-of-service in the Synology Router Manager environment. The impact on confidentiality, integrity, and availability is limited, reflecting the medium severity rating. There is no indication of exposure to unauthenticated attackers or critical data compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrator access to trusted users only and monitor for unusual activity related to Safe Access and SRM. Avoid exposing the management interface to untrusted networks. Follow Synology's official channels for updates on patches or mitigations.