CVE-2024-10441

A CWE-116 class error involving improper encoding or escaping of output data in a system plugin daemon. An attacker can deliver specially crafted data over the network, which — due to lack of proper sanitization — is then interpreted and executed by the system in an unintended manner. The attack vector is network-based (AV:N), requires no privileges (PR:N) and no user interaction (UI:N), making this vulnerability particularly dangerous.

Successful exploitation of this vulnerability allows a remote attacker to execute arbitrary code (RCE) on the vulnerable device, potentially gaining full control over it, accessing stored data, or modifying system configuration.

Synology BeeStation OS (BSM) should be immediately updated to version 1.1-65374 or later, and Synology DiskStation Manager (DSM) should be updated to version 7.2-64570-4, 7.2.1-69057-6, or 7.2.2-72806-1 (depending on the branch in use). Detailed information is available in the vendor's security advisories: Synology_SA_24_20 and Synology_SA_24_23.

Synology BeeStation OS (BSM) versions prior to 1.1-65374 and Synology DiskStation Manager (DSM) versions prior to 7.2-64570-4, 7.2.1-69057-6, and 7.2.2-72806-1