PT-2024-9746 · Synology · Synology Media Server

Team Tgls · Published 2024-05-03 · Updated 2026-01-29 · CVE-2024-4464

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Synology Media Server versions prior to 1.4-2680 Synology Media Server versions prior to 2.0.5-3152 Synology Media Server versions prior to 2.2.0-3325

Description The issue is related to an authorization bypass vulnerability through a user-controlled key in the streaming service of Synology Media Server. This vulnerability allows remote attackers to read specific files via unspecified vectors.

Recommendations For Synology Media Server versions prior to 1.4-2680, update to version 1.4-2680 or later. For Synology Media Server versions prior to 2.0.5-3152, update to version 2.0.5-3152 or later. For Synology Media Server versions prior to 2.2.0-3325, update to version 2.2.0-3325 or later.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

BDU:2024-11482

CVE-2024-4464

Affected Products

Synology Media Server

References · 11

• https://synology.com/en-global/security/advisory/Synology_SA_24_28 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-4464 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-11482 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-4464 · Security Note
• https://t.me/cveNotify/150285 · Telegram Post
• https://twitter.com/CVEnew/status/1869266350201258346 · Twitter Post
• https://vuldb.com/?id.288820 · Note
• https://twitter.com/VulmonFeeds/status/1869314565139321187 · Twitter Post
• https://twitter.com/cracbot/status/1871073309112299787 · Twitter Post
• https://t.me/cvedetector/13164 · Telegram Post
• https://t.me/cvenotify/104657 · Telegram Post