PT-2025-49024 · Synology · Synology Diskstation Manager+1

Steven Lin · Published 2025-12-04 · Updated 2025-12-09 · CVE-2024-45538

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Synology DiskStation Manager (DSM) versions prior to 7.2.1-69057-2 Synology DiskStation Manager (DSM) versions 7.2.1-69057-2 through 7.2.2-72806 Synology Unified Controller (DSMUC) versions prior to 3.1.4-23079

Description A Cross-Site Request Forgery (CSRF) issue exists in the WebAPI Framework of Synology DiskStation Manager (DSM) and Synology Unified Controller (DSMUC). This allows remote attackers to potentially execute arbitrary code through unspecified methods.

Recommendations Update Synology DiskStation Manager (DSM) to version 7.2.1-69057-2 or later. Update Synology DiskStation Manager (DSM) to version 7.2.2-72806 or later. Update Synology Unified Controller (DSMUC) to version 3.1.4-23079 or later.

Fix

RCE

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2024-45538

Affected Products

Synology Diskstation Manager

Synology Unified Controller

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-45538 · Security Note
• https://osv.dev/vulnerability/CVE-2024-45538 · Vendor Advisory
• https://synology.com/en-global/security/advisory/Synology_SA_24_27 · Vendor Advisory
• https://twitter.com/CVEnew/status/1996592405303427470 · Twitter Post
• https://twitter.com/cracbot/status/1998346929139568698 · Twitter Post
• https://t.me/CVEtracker/38811 · Telegram Post
• https://twitter.com/CCBalert/status/1996914069391938047 · Twitter Post
• https://t.me/cveNotify/144956 · Telegram Post
• https://twitter.com/CveFindCom/status/1996605263399322018 · Twitter Post