CVE-2024-10442

Published Mar 19, 2025

Last updated 4 months ago

Synology

Overview

AI description

Automated description summarized from trusted sources.

CVE-2024-10442 is an off-by-one error vulnerability found in the transmission component of Synology Replication Service and Synology Unified Controller (DSMUC). This vulnerability affects Synology Replication Service versions before 1.0.12-0066, 1.2.2-0353, and 1.3.0-0423, as well as Synology Unified Controller (DSMUC) versions before 3.1.4-23079. The flaw allows unauthenticated remote attackers to potentially execute arbitrary code on affected systems. This is due to improper bounds checking, which could permit an attacker to write data beyond the allocated buffer by sending a specially crafted input.

Description: Off-by-one error vulnerability in the transmission component in Synology Replication Service before 1.0.12-0066, 1.2.2-0353 and 1.3.0-0423 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote attackers to execute arbitrary code, potentially leading to a broader impact across the system via unspecified vectors.
Source: security@synology.com
NVD status: Analyzed
Products: unified_controller, replication_service, replication_service

Risk scores

CVSS 3.1

Type: Secondary
Base score: 10
Impact score: 6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

security@synology.com: CWE-193

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:synology:unified_controller:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "819A9BB9-6FAE-4F70-9C08-BCF9F8DE8F8C",
            "versionEndExcluding": "3.1.4-23079",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      },
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:synology:diskstation_manager_unified_controller:3.1:*:*:*:*:*:*:*",
            "matchCriteriaId": "1C199245-E7B1-496C-9977-F422B0F7DB08",
            "vulnerable": false
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ],
    "operator": "AND"
  },
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:synology:replication_service:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "8B038C0B-1F79-4870-BD3F-9496274651D6",
            "versionEndIncluding": "1.0.12-0066",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      },
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:synology:diskstation_manager:6.2:*:*:*:*:*:*:*",
            "matchCriteriaId": "D9685B12-824F-42AD-B87C-6E7A78BB7FA5",
            "vulnerable": false
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ],
    "operator": "AND"
  },
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:synology:replication_service:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "EE1A1281-F888-4140-88E3-993DEA60F6BD",
            "versionEndExcluding": "1.2.2-0353",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      },
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:synology:diskstation_manager:7.1:*:*:*:*:*:*:*",
            "matchCriteriaId": "10C4B055-D99B-4D58-811C-DD323A68A890",
            "vulnerable": false
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ],
    "operator": "AND"
  },
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:syncology:replication_service:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "43FA757B-41C7-486F-B258-744D34AACB2B",
            "versionEndExcluding": "1.3.0-0423",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      },
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:synology:diskstation_manager:7.2:*:*:*:*:*:*:*",
            "matchCriteriaId": "5C262042-304B-49DC-BB4B-655C5C36D88C",
            "vulnerable": false
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ],
    "operator": "AND"
  }
]

Improper encoding or escaping of output vulnerability in the system plugin daemon in Synology BeeStation OS (BSM) before 1.1-65374 and Synology DiskStation Manager (DSM) before 7.2-64570-4, 7.2.1-69057-6 and 7.2.2-72806-1 allows remote attackers to execute arbitrary code via unspecified vectors.•CVE-2024-10441

References

Sources include official advisories and independent security research.