Vulnerability · Published Mar 19, 2025 · Assigned by synology
CVE-2024-50631
High 7.5
In plain English
A high-severity SQL injection in Synology Drive Server from Synology. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 26.8% (higher than 98% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)26.8%top 2.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in the system syncing daemon in Synology Drive Server before 3.0.4-12699, 3.2.1-23280, 3.5.0-26085 and 3.5.1-26102 allows remote attackers to inject SQL commands, limited to write operations, via unspecified vectors.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Synology | Synology Drive Server | * – before 3.5.1-26102* – before 3.5.0-26085* – before 3.2.1-23280* – before 3.0.4-12699 |
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
References
- Synology-SA-24:21 Synology Drive Server (PWN2OWN 2024) vendor-advisory