Vulnerability · Published Mar 19, 2025 · Assigned by synology

CVE-2024-10441

Critical 9.8

In plain English

A critical-severity security flaw in BeeStation OS (BSM) from Synology. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 70% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)1.3%top 30.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

Improper encoding or escaping of output vulnerability in the system plugin daemon in Synology BeeStation OS (BSM) before 1.1-65374 and Synology DiskStation Manager (DSM) before 7.2-64570-4, 7.2.1-69057-6 and 7.2.2-72806-1 allows remote attackers to execute arbitrary code via unspecified vectors.

Affected products (as reported)

Vendor	Product	Versions
Synology	DiskStation Manager (DSM)	7.2.2 – before 7.2.2-72806-17.2.1 – before 7.2.1-69057-67.2 – before 7.2-64570-47.1 – before 7.1.1-42962-7
Synology	BeeStation OS (BSM)	1.1 – before 1.1-653741.0 – before 1.1-65374

Weakness: CWE-116 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Synology-SA-24:20 DSM (PWN2OWN 2024) vendor-advisory
Synology-SA-24:23 BeeStation (PWN2OWN 2024) vendor-advisory