CVE-2024-10441

Published: Mar 19, 2025Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: security@synology.com (Secondary)

Description

Improper encoding or escaping of output vulnerability in the system plugin daemon in Synology BeeStation OS (BSM) before 1.1-65374 and Synology DiskStation Manager (DSM) before 7.2-64570-4, 7.2.1-69057-6 and 7.2.2-72806-1 allows remote attackers to execute arbitrary code via unspecified vectors.

Affected (12)

Products: Synology: Beestation Os, Diskstation Manager

Synology

2 products

Beestation Os

Diskstation Manager

Configuration A

12 vulnerable

Vulnerable Software	Affected Versions
Synology Beestation Os	Version 1.0.1 65210
Synology Beestation Os	Version 1.0.2 65233
Synology Beestation Os	Version 1.0.2 65235
Synology Beestation Os	Version 1.0
Synology Beestation Os	Version 1.0 65145
Synology Beestation Os	Version 1.0 65149
Synology Beestation Os	Version 1.0 65162
Synology Beestation Os	Version 1.1
Synology Beestation Os	Version 1.1 65373
Synology Diskstation Manager	From 7.2 to 7.2-64570-4
Synology Diskstation Manager	From 7.2.1-69057 to 7.2.1-69057-6
Synology Diskstation Manager	From 7.2.2 to 7.2.2-72806-1

Related CWEs

CWE-116

Improper Encoding or Escaping of Output

The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

References (2)

https://www.synology.com/en-global/security/advisory/Synology_SA_24_20

Source: security@synology.com

Vendor Advisory

https://www.synology.com/en-global/security/advisory/Synology_SA_24_23

Source: security@synology.com

Vendor Advisory

Timeline

No history available yet.