Paper/Archive/CVE-2024-10441

CVE-2024-10441

Synology DiskStation Manager (DSM) — Improper encoding or escaping of output vulnerability in the system plugin daemon in Synology BeeStation OS (BSM) before 1.1-65374 and Sy…

EPSS 1%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (CNA)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 69.4.694 × 2013.9 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Improper encoding or escaping of output vulnerability in the system plugin daemon in Synology BeeStation OS (BSM) before 1.1-65374 and Synology DiskStation Manager (DSM) before 7.2-64570-4, 7.2.1-69057-6 and 7.2.2-72806-1 allows remote attackers to execute arbitrary code via unspecified vectors.

Affected

ProductAffectedFixed inSource

DiskStation Manager (DSM)7.2.2 – < 7.2.2-72806-17.2.2-72806-1CNA

DiskStation Manager (DSM)7.2.1 – < 7.2.1-69057-67.2.1-69057-6CNA

DiskStation Manager (DSM)7.2 – < 7.2-64570-47.2-64570-4CNA

DiskStation Manager (DSM)7.1 – < 7.1.1-42962-77.1.1-42962-7CNA

BeeStation OS (BSM)1.1 – < 1.1-653741.1-65374CNA

BeeStation OS (BSM)1.0 – < 1.1-653741.1-65374CNA

Scores by source

synology (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisorysynology.com/en-global/security/advisory/Synology_SA_24_20 advisorysynology.com/en-global/security/advisory/Synology_SA_24_23