CVE-2024-10441

Analyzed Analyzed - Analysis Complete

BaseFortify

Publication date: 2025-03-19

Last updated on: 2025-11-17

Assigner: Synology Inc.

Description

Improper encoding or escaping of output vulnerability in the system plugin daemon in Synology BeeStation OS (BSM) before 1.1-65374 and Synology DiskStation Manager (DSM) before 7.2-64570-4, 7.2.1-69057-6 and 7.2.2-72806-1 allows remote attackers to execute arbitrary code via unspecified vectors.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-03-19

Last Modified

2025-11-17

Generated

2026-11-02

AI Q&A

2025-03-19

EPSS Evaluated

2026-10-31

NVD

CVE-2024-10441

EUVD

EUVD-2024-54098

Affected Vendors & Products

Vendor	Product	Version / Range
synology	beestation_os	1.0
synology	beestation_os	1.0
synology	beestation_os	1.0
synology	beestation_os	1.0
synology	beestation_os	1.0.1
synology	beestation_os	1.0.2
synology	beestation_os	1.0.2
synology	beestation_os	1.1
synology	beestation_os	1.1
synology	diskstation_manager	From 7.2 (inc) to 7.2-64570-4 (exc)
synology	diskstation_manager	From 7.2.1-69057 (inc) to 7.2.1-69057-6 (exc)
synology	diskstation_manager	From 7.2.2 (inc) to 7.2.2-72806-1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-116	The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

Attack-Flow Graph

Executive Summary

CVE-2024-10441 is an improper encoding or escaping of output vulnerability found in the system plugin daemon of Synology BeeStation Manager (BSM) and other Synology products. This vulnerability allows remote attackers to execute arbitrary code on affected systems through unspecified vectors. It affects versions of BSM prior to 1.1-65374, DiskStation Manager (DSM) before 6.2.4-25556-8, 7.1.1-42962-7, 7.2-64570-4, 7.2.1-69057-6, and 7.2.2-72806-1, as well as Synology Unified Controller (DSMUC) before 3.1.4-23079.

Detection Guidance

To detect this vulnerability, you can check the version of Synology DiskStation Manager (DSM) or BeeStation Manager (BSM) running on your system. Use the following command to check the version: `synoservice --status` or log into the DSM web interface and check the version in the control panel. Additionally, you can scan your network for vulnerable versions using tools like Nmap with a script that checks for specific versions.

Impact Analysis

This vulnerability can have a significant impact as it allows remote attackers to execute arbitrary code on your Synology devices. If exploited, this could lead to unauthorized access, data breaches, or complete system compromise, potentially resulting in loss of sensitive data, disruption of services, and damage to your organization's reputation.

Compliance Impact

The exploitation of CVE-2024-10441 could lead to unauthorized access to personal or sensitive data, which would violate compliance requirements under regulations such as GDPR and HIPAA. Non-compliance could result in legal penalties, fines, and loss of trust from customers and stakeholders, as organizations are required to protect personal data and ensure its confidentiality and integrity.

Mitigation Strategies

To mitigate this vulnerability, immediately update your Synology DiskStation Manager (DSM) or BeeStation Manager (BSM) to the latest version that addresses this issue. You can find the updates on the Synology website or through the DSM interface. Additionally, consider implementing network segmentation and firewall rules to limit access to the affected services until the update is applied.

Hi! I’m here to help you understand CVE-2024-10441. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...