PT-2024-28098 · Synology · Notes Station

Thomas Fady · Published 2024-11-22 · Updated 2024-12-02 · CVE-2024-38644

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Notes Station 3 versions prior to 3.9.7

Description An OS command injection issue has been reported, which could allow remote authenticated attackers to execute commands if exploited.

Recommendations For versions prior to 3.9.7, update to version 3.9.7 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive areas of the system to minimize the risk of exploitation.

Fix

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

CVE-2024-38644

Affected Products

Notes Station

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-38644 · Security Note
• https://osv.dev/vulnerability/CVE-2024-38644 · Vendor Advisory
• https://twitter.com/mr_akbarzadeh/status/1863493303225684066 · Twitter Post
• https://twitter.com/CveFindCom/status/1859991597896589394 · Twitter Post
• https://twitter.com/CVEnew/status/1859988109523308743 · Twitter Post
• https://qnap.com/en/security-advisory/qsa-24-36 · Note
• https://twitter.com/VulmonFeeds/status/1861845862424494418 · Twitter Post
• https://t.me/latest_high_impact_cve/1544 · Telegram Post