Vulnerability · Published Mar 19, 2025 · Assigned by synology
CVE-2024-50630
High 7.5
In plain English
A high-severity missing authentication in Synology Drive Server from Synology. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 24.6% (higher than 98% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)24.6%top 2.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Missing authentication for critical function vulnerability in the webapi component in Synology Drive Server before 3.0.4-12699, 3.2.1-23280, 3.5.0-26085 and 3.5.1-26102 allows remote attackers to obtain administrator credentials via unspecified vectors.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Synology | Synology Drive Server | * – before 3.0.4-12699* – before 3.5.1-26102* – before 3.5.0-26085* – before 3.2.1-23280 |
Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- Synology-SA-24:21 Synology Drive Server (PWN2OWN 2024) vendor-advisory