CRITICAL✓ PATCH🇵🇱 Wersja polska

CVE-2024-45538

CVSS 9.6v3.1pub. 2025-12-04upd. 2025-12-05

Cross-Site Request Forgery (CSRF) vulnerability in WebAPI Framework in Synology DiskStation Manager (DSM) before 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote attackers to execute arbitrary code via unspecified vectors.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

  • Synology Diskstation Manager

    OS
    Synology
    7.2.1-69057 – 7.2.1-69057-2 (bez)7.2.2-72803 – 7.2.2-72806 (bez)

  • Synology Diskstation Manager Unified Controller

    OS
    Synology
    3.1-23028 – 3.1.4-23079 (bez)
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
Tags
RCE
CWE
References

Related vulnerabilities

CVE-2024-10441CRITICAL9.8PL ✓ten sam produkt

RCE w Synology BeeStation OS i DSM — błąd kodowania wyjścia w systemowym daemonie

CVE-2024-10442CRITICAL10.0PL ✓ten sam produkt

RCE przez błąd off-by-one w komponencie transmisji Synology Replication Service

CVE-2024-10443CRITICAL9.8PL ✓ten sam produkt

OS Command Injection w Synology BeePhotos i Synology Photos — RCE bez uwierzytelnienia

CVE-2024-29241CRITICAL9.9PL ✓ten sam produkt

Brak autoryzacji w Synology Surveillance Station — zapis konfiguracji i restart NAS

CVE-2022-27625CRITICAL10.0ten sam produkt

A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in ...