PT-2025-11661 · Synology · Synology Unified Controller+2

Published

2024-11-05

·

Updated

2026-05-30

·

CVE-2024-50629

CVSS v3.1

5.3

Medium

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Name of the Vulnerable Software and Affected Versions Synology BeeStation Manager (BSM) versions prior to 1.1-65374 Synology DiskStation Manager (DSM) versions prior to 6.2.4-25556-8 Synology DiskStation Manager (DSM) versions prior to 7.1.1-42962-7 Synology DiskStation Manager (DSM) versions prior to 7.2-64570-4 Synology DiskStation Manager (DSM) versions prior to 7.2.1-69057-6 Synology DiskStation Manager (DSM) versions prior to 7.2.2-72806-1 Synology Unified Controller (DSMUC) versions prior to 3.1.4-23079
Description An improper encoding or escaping of output issue exists within the 'webapi' component. This flaw allows remote attackers to read limited files through unspecified vectors. The issue is associated with CRLF injection, which can lead to information disclosure.
Recommendations Update Synology BeeStation Manager (BSM) to version 1.1-65374 or later. Update Synology DiskStation Manager (DSM) to version 6.2.4-25556-8 or later. Update Synology DiskStation Manager (DSM) to version 7.1.1-42962-7 or later. Update Synology DiskStation Manager (DSM) to version 7.2-64570-4 or later. Update Synology DiskStation Manager (DSM) to version 7.2.1-69057-6 or later. Update Synology DiskStation Manager (DSM) to version 7.2.2-72806-1 or later. Update Synology Unified Controller (DSMUC) to version 3.1.4-23079 or later.

Fix

RCE

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-116

Related Identifiers

BDU:2025-03798
CVE-2024-50629
ZDI-25-211

Affected Products

Synology Beestation Manager
Synology Diskstation Manager
Synology Unified Controller