PT-2025-11661 · Synology · Synology Beestation Manager+2

CVE-2024-50629 · Published 2024-11-05 · Updated 2026-05-30

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Synology BeeStation Manager (BSM) versions prior to 1.1-65374 Synology DiskStation Manager (DSM) versions prior to 6.2.4-25556-8 Synology DiskStation Manager (DSM) versions prior to 7.1.1-42962-7 Synology DiskStation Manager (DSM) versions prior to 7.2-64570-4 Synology DiskStation Manager (DSM) versions prior to 7.2.1-69057-6 Synology DiskStation Manager (DSM) versions prior to 7.2.2-72806-1 Synology Unified Controller (DSMUC) versions prior to 3.1.4-23079

Description An improper encoding or escaping of output issue exists within the 'webapi' component. This flaw allows remote attackers to read limited files through unspecified vectors. The issue is associated with CRLF injection, which can lead to information disclosure.

Recommendations Update Synology BeeStation Manager (BSM) to version 1.1-65374 or later. Update Synology DiskStation Manager (DSM) to version 6.2.4-25556-8 or later. Update Synology DiskStation Manager (DSM) to version 7.1.1-42962-7 or later. Update Synology DiskStation Manager (DSM) to version 7.2-64570-4 or later. Update Synology DiskStation Manager (DSM) to version 7.2.1-69057-6 or later. Update Synology DiskStation Manager (DSM) to version 7.2.2-72806-1 or later. Update Synology Unified Controller (DSMUC) to version 3.1.4-23079 or later.

Fix

RCE

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-116

Related Identifiers

BDU:2025-03798

CVE-2024-50629

ZDI-25-211

Affected Products

Synology Beestation Manager

Synology Diskstation Manager

Synology Unified Controller

References · 34

• https://osv.dev/vulnerability/CVE-2024-50629 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-03798 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-25-211 · Security Note
• https://synology.com/en-global/security/advisory/Synology_SA_24_20 · Vendor Advisory
• https://synology.com/en-global/security/advisory/Synology_SA_24_23 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-50629 · Security Note
• https://t.me/proxy_bar/3434 · Telegram Post
• https://twitter.com/CVEnew/status/1902243761402384796 · Twitter Post
• https://twitter.com/blackstormsecbr/status/2007901124519735709 · Twitter Post
• https://twitter.com/vuln_tracker/status/2029849384893165571 · Twitter Post
• https://reddit.com/r/CVEWatch/comments/1sl48wa/top_10_trending_cves_14042026 · Reddit Post
• https://twitter.com/0xor0ne/status/2029829614072156457 · Twitter Post
• https://t.me/proxy_bar/3435 · Telegram Post
• https://twitter.com/kiddo_pwn/status/1995435316304588881 · Twitter Post
• https://t.me/cvetracker/19420 · Telegram Post