CVE-2024-10442

Published: Mar 19, 2025Modified: Jun 17, 2026

10.0

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 6.0

Source: security@synology.com (Secondary)

Description

Off-by-one error vulnerability in the transmission component in Synology Replication Service before 1.0.12-0066, 1.2.2-0353 and 1.3.0-0423 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote attackers to execute arbitrary code, potentially leading to a broader impact across the system via unspecified vectors.

Affected (4)

Products: Synology: Unified Controller, Replication Service · Syncology: Replication Service

2 products

1 product

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Synology Unified Controller	Before 3.1.4-23079

Running on/with	Platform Versions
Synology Diskstation Manager Unified Controller	Version 3.1

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Synology Replication Service	Up to 1.0.12-0066

Running on/with	Platform Versions
Synology Diskstation Manager	Version 6.2

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Synology Replication Service	Before 1.2.2-0353

Running on/with	Platform Versions
Synology Diskstation Manager	Version 7.1

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Syncology Replication Service	Before 1.3.0-0423

Running on/with	Platform Versions
Synology Diskstation Manager	Version 7.2

Related CWEs

CWE-193

Off-by-one Error

A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.

References (1)

https://www.synology.com/en-global/security/advisory/Synology_SA_24_22

Source: security@synology.com

Vendor Advisory

Timeline

No history available yet.