CVE-2024-45538 — CRITICAL (9.6)

Q: How severe is CVE-2024-45538?

CVE-2024-45538 has been rated CRITICAL with a CVSS base score of 9.6/10. This is considered a critical vulnerability requiring immediate attention.

Q: Is there a patch for CVE-2024-45538?

Check the references section above for vendor advisories and patch information. Affected products include: Synology Diskstation Manager, Synology Diskstation Manager Unified Controller.

Vulnerability Description

Cross-Site Request Forgery (CSRF) vulnerability in WebAPI Framework in Synology DiskStation Manager (DSM) before 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote attackers to execute arbitrary code via unspecified vectors.

CVSS Score

9.6

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Synology	Diskstation Manager	>= 7.2.1-69057, < 7.2.1-69057-2
Synology	Diskstation Manager Unified Controller	>= 3.1-23028, < 3.1.4-23079

Related Weaknesses (CWE)

CWE-352

References

https://www.synology.com/en-global/security/advisory/Synology_SA_24_27Vendor Advisory

FAQ

What is CVE-2024-45538?

CVE-2024-45538 is a vulnerability with a CVSS score of 9.6 (CRITICAL). Cross-Site Request Forgery (CSRF) vulnerability in WebAPI Framework in Synology DiskStation Manager (DSM) before 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller (DSMUC) before 3.1.4-2307...

How severe is CVE-2024-45538?

CVE-2024-45538 has been rated CRITICAL with a CVSS base score of 9.6/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2024-45538?

Check the references section above for vendor advisories and patch information. Affected products include: Synology Diskstation Manager, Synology Diskstation Manager Unified Controller.