PT-2025-11655 · Synology · Synology Application Service+1

Published

2024-11-05

·

Updated

2025-05-03

·

CVE-2024-10442

CVSS v3.1

10

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Synology Replication Service versions prior to 1.0.12-0066, 1.2.2-0353, and 1.3.0-0423 Synology Unified Controller (DSMUC) versions prior to 3.1.4-23079
Description The vulnerability is an off-by-one error in the transmission component of Synology Replication Service, allowing remote attackers to execute arbitrary code. This could lead to a broader impact across the system via unspecified vectors. The issue has been exploited at Pwn2Own Ireland, demonstrating remote code execution to root via out-of-bounds NULL-byte writes.
Recommendations
  • For Synology Replication Service versions prior to 1.0.12-0066, update to version 1.0.12-0066 or later.
  • For Synology Replication Service versions prior to 1.2.2-0353, update to version 1.2.2-0353 or later.
  • For Synology Replication Service versions prior to 1.3.0-0423, update to version 1.3.0-0423 or later.
  • For Synology Unified Controller (DSMUC) versions prior to 3.1.4-23079, update to version 3.1.4-23079 or later.
  • As a temporary workaround, consider disabling the Synology Replication Service until a patch is available.

Fix

RCE

Weakness Enumeration

CWE-193

Related Identifiers

BDU:2025-04032
CVE-2024-10442
ZDI-25-208

Affected Products

Synology Application Service
Synology Unified Controller