CVE-2024-5401

MEDIUM

Synology DSM <7.1.1-42962-8, <7.2.1-69057-2, <7.2.2-72806 - Privile...

Title source: llm

Description

Improper control of dynamically-managed code resources vulnerability in WebAPI component in Synology DiskStation Manager (DSM) before 7.1.1-42962-8 and 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote authenticated users to obtain privileges without consent via unspecified vectors.

References (1)

[Vendor Advisory] https://www.synology.com/en-global/security/advisory/Synology_SA_24_27

Scores

CVSS v3 4.3

EPSS 0.0006

EPSS Percentile 18.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Classification

CWE

CWE-913

Status published

Affected Products (2)

synology/diskstation_manager < 7.2.1-69057-2

synology/diskstation_manager_unified_controller < 3.1.4-23079

Timeline

Published Dec 04, 2025

Tracked Since Feb 18, 2026