Skip to content
OpenAdvisories
Critical · 9.8 Public exploit CVE-2024-10441 EUVD-2024-54098GHSA-3hx6-3qqx-qhvf

Improper encoding or escaping of output vulnerability in the system plugin daemon in Synology BeeStation OS (BSM) before 1.1-65374 and Syno…

Published Mar 19, 2025 · Updated Mar 28, 2025 · Assigned by synology

Vendor: Synology Product: BeeStation OS (BSM) Product: DiskStation Manager (DSM)

Description

Improper encoding or escaping of output vulnerability in the system plugin daemon in Synology BeeStation OS (BSM) before 1.1-65374 and Synology DiskStation Manager (DSM) before 7.2-64570-4, 7.2.1-69057-6 and 7.2.2-72806-1 allows remote attackers to execute arbitrary code via unspecified vectors.

Affected products

VendorProductAffectedFixed
Synology DiskStation Manager (DSM) 7.2.2 – < 7.2.2-72806-1, 7.2.1 – < 7.2.1-69057-6, 7.2 – < 7.2-64570-4, 7.1 – < 7.1.1-42962-7 7.2.2-72806-1
Synology BeeStation OS (BSM) 1.1 – < 1.1-65374, 1.0 – < 1.1-65374 1.1-65374

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 2 repositories

  • SHIFox8/synology-dsm-vuln-scanner ★ 3 · Oct 30, 2026

    Detection-only vulnerability scanner for Synology DSM — CVE-2024-10441 (SA-24:20, ransomware-exploited) and CVE-2026-13684/13639 (SA-26:13). Read-only fingerprinting, no exploits. Python 3.9+, zero d…

  • Ntn10/cve-2024-10441-synology-rce ★ 1 · Oct 25, 2026

    Writeup y PoC educativo de CVE-2024-10441 (RCE pre-auth como root en Synology DSM via synoplugind). CVE ya parcheado; uso autorizado/defensivo.

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 1

References