CVE-2024-10443

Published Nov 15, 2024

Last updated 8 months ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2024-10443 is an OS command injection vulnerability found in the Task Manager component of Synology BeePhotos and Synology Photos applications. This flaw allows remote attackers to execute arbitrary code on affected systems. Notably, it is classified as a "zero-click" vulnerability, meaning that successful exploitation does not require any user interaction or authentication. The vulnerability stems from the improper neutralization of special elements used in OS commands. This allows attackers to inject malicious commands through unspecified vectors, bypassing the intended command context. The affected versions include Synology BeePhotos before 1.0.2-10026 and 1.1.0-10053, and Synology Photos before 1.6.2-0720 and 1.7.0-0795.

Description: Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in Task Manager component in Synology BeePhotos before 1.0.2-10026 and 1.1.0-10053 and Synology Photos before 1.6.2-0720 and 1.7.0-0795 allows remote attackers to execute arbitrary code via unspecified vectors.
Source: security@synology.com
NVD status: Modified
Products: photos, beephotos

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

security@synology.com: CWE-78
nvd@nist.gov: CWE-77

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:synology:photos:*:*:*:*:*:diskstation_manager:*:*",
            "matchCriteriaId": "419F75B4-D207-4288-8497-4B3A8C583E46",
            "versionEndExcluding": "1.6.2-0720",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      },
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:synology:diskstation_manager:7.2:*:*:*:*:*:*:*",
            "matchCriteriaId": "5C262042-304B-49DC-BB4B-655C5C36D88C",
            "vulnerable": false
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ],
    "operator": "AND"
  },
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:synology:beephotos:*:*:*:*:*:beestation_os:*:*",
            "matchCriteriaId": "47E33443-30C1-42A0-8876-405FD9AC155A",
            "versionEndExcluding": "1.1.0-10053",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      },
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:synology:beestation_os:1.1:*:*:*:*:*:*:*",
            "matchCriteriaId": "E456DD53-9402-48F7-98F8-8CEE480D8337",
            "vulnerable": false
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ],
    "operator": "AND"
  },
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:synology:beephotos:*:*:*:*:*:beestation_os:*:*",
            "matchCriteriaId": "A8BA8374-E7BE-406B-82E8-5EDBED2551EF",
            "versionEndExcluding": "1.0.2-10026",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      },
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:synology:beestation_os:1.0:*:*:*:*:*:*:*",
            "matchCriteriaId": "DCDD1FA9-719E-4C69-9D72-29B154E27849",
            "vulnerable": false
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ],
    "operator": "AND"
  },
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:synology:photos:*:*:*:*:*:diskstation_manager:*:*",
            "matchCriteriaId": "71B932C6-C930-4C9A-9C75-CFEAFB41BD24",
            "versionEndExcluding": "1.7.0-0795",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      },
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:synology:diskstation_manager:7.2.2:*:*:*:*:*:*:*",
            "matchCriteriaId": "4E22F435-F709-495B-84B4-A478C63331B9",
            "vulnerable": false
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ],
    "operator": "AND"
  }
]

References

Sources include official advisories and independent security research.