Vulnerability · Published Mar 19, 2025 · Assigned by synology
CVE-2024-50629
Medium 5.3
In plain English
A medium-severity security flaw in BeeStation OS (BSM) from Synology. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 34.8% (higher than 98% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
Improper encoding or escaping of output vulnerability in the webapi component in Synology BeeStation OS (BSM) before 1.1-65374 and Synology DiskStation Manager (DSM) before 7.1.1-42962-7, 7.2-64570-4, 7.2.1-69057-6 and 7.2.2-72806-1 allow remote attackers to read limited files via unspecified vectors.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Synology | DiskStation Manager (DSM) | 7.2.2 – before 7.2.2-72806-17.2.1 – before 7.2.1-69057-67.2 – before 7.2-64570-47.1 – before 7.1.1-42962-7 |
| Synology | BeeStation OS (BSM) | 1.1 – before 1.1-653741.0 – before 1.1-65374 |
Weakness: CWE-116 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
- Synology-SA-24:20 DSM (PWN2OWN 2024) vendor-advisory
- Synology-SA-24:23 BeeStation (PWN2OWN 2024) vendor-advisory