High WID-SEC-2024-3378 3 CVEs

Synology DiskStation Manager: Mehrere Schwachstellen

Published Nov 7, 2024 · Updated Mar 18, 2025 · Revision 3 · de-DE

Vendor: Synology Product: DiskStation Manager

Summary

Ein Angreifer kann mehrere Schwachstellen im Synology DiskStation Manager ausnutzen, um beliebigen Code auszuführen, Administrator-Sitzungen zu übernehmen und um Informationen offenzulegen oder zu manipulieren.

Product

DiskStation Manager (DSM) ist ein webbasiertes Betriebssystem für Synology NAS-Geräte.

Vulnerabilities 3

Critical 9.8

CVE-2024-10441 Public exploit

Improper encoding or escaping of output vulnerability in the system plugin daemon in Synology BeeStation OS (BSM) befor…

Synology DiskStation Manager (DSM) BeeStation OS (BSM)

Mar 19, 2025
Medium 5.3

CVE-2024-50629 Public exploit EPSS 35%

Improper encoding or escaping of output vulnerability in the webapi component in Synology BeeStation OS (BSM) before 1.…

Synology DiskStation Manager (DSM) BeeStation OS (BSM)

Mar 19, 2025
Medium 4.3

CVE-2024-10445

Improper certificate validation vulnerability in the update functionality in Synology BeeStation OS (BSM) before 1.1-65…

Synology DiskStation Manager (DSM) BeeStation OS (BSM)

Mar 19, 2025

Revision history

2025-03-18 #3
CVE's ergänzt
2025-02-04 #2
Update von Synology
2024-11-07 #1
Initiale Fassung

References

Synology Security Advisory Synology-SA-24:20 DSM (PWN2OWN 2024) vom 2024-11-07
https://www.synology.com/en-global/support/security/Synology_SA_24_20
Synology Security Advisory Synology-SA-25:01 DSM (PWN2OWN 2024) vom 2025-02-04
https://www.synology.com/de-de/security/advisory/Synology_SA_25_01