PT-2024-7608 · Synology · Synology Beephotos+1

Rick De Jager

·

Published

2024-10-25

·

Updated

2026-03-27

·

CVE-2024-10443

CVSS v2.0

10

Critical

VectorAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Synology BeePhotos versions prior to 1.0.2-10026 Synology BeePhotos version 1.1.0-10053 Synology Photos versions prior to 1.6.2-0720 Synology Photos version 1.7.0-0795 Synology BeeStation BST150-4T (affected versions not specified)
Description A command injection flaw exists in the Task Manager component of Synology BeePhotos and Synology Photos. This issue allows remote attackers to execute arbitrary code without user interaction. Millions of Synology NAS devices are potentially affected. The vulnerability, dubbed RISK:STATION, was demonstrated at Pwn2Own 2024 and is actively exploited. The root cause is improper neutralization of special elements used in OS commands. The vulnerable component is the Task Manager. The vulnerability allows an attacker to gain root-level access to affected devices.
Recommendations Update Synology BeePhotos to version 1.0.2-10026 or later. Update Synology BeePhotos to version 1.1.0-10053 or later. Update Synology Photos to version 1.6.2-0720 or later. Update Synology Photos to version 1.7.0-0795 or later.

Fix

RCE

Improper Privilege Management

OS Command Injection

Command Injection

Weakness Enumeration

CWE-269CWE-78CWE-77

Related Identifiers

BDU:2024-09014
CVE-2024-10443
ZDI-25-207

Affected Products

Synology Beephotos
Synology Photos