PT-2025-11653 · Synology · Synology Diskstation Manager

Chris Anastasio + 1 · Published 2024-11-05 · Updated 2025-11-17 · CVE-2024-10444

Positive Technologies (AI Summary)

CVSS v2.0

7.6

High

Base vector

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Synology DiskStation Manager (DSM) versions prior to 7.1.1-42962-8 Synology DiskStation Manager (DSM) versions prior to 7.2.1-69057-7 Synology DiskStation Manager (DSM) versions prior to 7.2.2-72806-3

Description The issue is related to improper certificate validation in the LDAP utilities, allowing man-in-the-middle attackers to hijack the authentication of administrators.

Recommendations For versions prior to 7.1.1-42962-8, update to version 7.1.1-42962-8 or later. For versions prior to 7.2.1-69057-7, update to version 7.2.1-69057-7 or later. For versions prior to 7.2.2-72806-3, update to version 7.2.2-72806-3 or later.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

BDU:2025-10541

CVE-2024-10444

ZDI-25-215

Affected Products

Synology Diskstation Manager

References · 13

• https://bdu.fstec.ru/vul/2025-10541 · Security Note
• https://synology.com/en-global/security/advisory/Synology_SA_25_01 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-10444 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-25-215 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-10444 · Security Note
• https://t.me/cvedetector/20612 · Telegram Post
• https://twitter.com/cracbot/status/1904126111782736255 · Twitter Post
• https://twitter.com/CVEnew/status/1902195205409009997 · Twitter Post
• https://t.me/cvenotify/115287 · Telegram Post
• https://t.me/cveNotify/143031 · Telegram Post
• https://twitter.com/RedTeamNewsBlog/status/1903986140627230789 · Twitter Post
• https://t.me/cvetracker/19412 · Telegram Post
• https://twitter.com/TheZDIBugs/status/1910074387904053743 · Twitter Post