CVE-2024-45538

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-45538

9.6 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

C

ross-Site Request Forgery (CSRF) vulnerability in WebAPI Framework in Synology DiskStation Manager (DSM) before 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote attackers to execute arbitrary code via unspecified vectors.

References
Link Resource
https://www.synology.com/en-global/security/advisory/Synology_SA_24_27 Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:synology:diskstation_manager:*:*:*:*:*:*:*:*
cpe:2.3:o:synology:diskstation_manager:*:*:*:*:*:*:*:*
cpe:2.3:o:synology:diskstation_manager_unified_controller:*:*:*:*:*:*:*:*
History

05 Dec 2025, 21:44

Type Values Removed Values Added
New CVE
Information

Published : 2025-12-04 15:15

Updated : 2025-12-05 21:44

NVD link : CVE-2024-45538

Mitre link : CVE-2024-45538

CVE.ORG link : CVE-2024-45538

JSON object : View

Products Affected

synology

CWE
CWE-352

Cross-Site Request Forgery (CSRF)