Skip to main content

Diskstation Manager CVE-2024-5401

| EUVDEUVD-2024-55300 MEDIUM
Improper Control of Dynamically-Managed Code Resources (CWE-913)
2025-12-04 security@synology.com
Synology Information Disclosure Diskstation Manager Diskstation Manager Unified Controller
4.3
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
4.3 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None

Lifecycle Timeline

4
Patch available
Apr 16, 2026 - 05:29 EUVD
7.2.1-69057-2,7.2.2-72806,3.1.4-23079
EUVD ID Assigned
Mar 15, 2026 - 16:35 euvd
EUVD-2024-55300
Analysis Generated
Mar 15, 2026 - 16:35 vuln.today
CVE Published
Dec 04, 2025 - 15:15 nvd
MEDIUM 4.3

DescriptionCVE.org

Improper control of dynamically-managed code resources vulnerability in WebAPI component in Synology DiskStation Manager (DSM) before 7.1.1-42962-8 and 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote authenticated users to obtain privileges without consent via unspecified vectors.

Analysis

Improper control of dynamically-managed code resources vulnerability in WebAPI component in Synology DiskStation Manager (DSM) before 7.1.1-42962-8 and 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote authenticated users to obtain privileges without consent via unspecified vectors.

Technical ContextAI

This vulnerability is classified as Improper Control of Dynamically-Managed Code Resources (CWE-913).

RemediationAI

Monitor vendor advisories for patches. Apply mitigations such as network segmentation, access restrictions, and monitoring.

More in Diskstation Manager

View all
CVE-2013-6955 CRITICAL POC
10.0 Jan 09

webman/imageSelector.cgi in Synology DiskStation Manager (DSM) 4.0 before 4.0-2259, 4.2 before 4.2-3243, and 4.3 before

CVE-2017-5753 MEDIUM POC
5.6 Jan 04

Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of

CVE-2017-15889 HIGH POC
8.8 Dec 04

Command injection vulnerability in smart.cgi in Synology DiskStation Manager (DSM) before 5.2-5967-5 allows remote authe
CVE-2017-14491 CRITICAL POC
9.8 Oct 04

Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execut
CVE-2017-9554 MEDIUM POC
5.3 Jul 24

An information exposure vulnerability in forget_passwd.cgi in Synology DiskStation Manager (DSM) before 6.1.3-15152 allo
CVE-2013-6987 HIGH POC
7.5 Dec 31

Multiple directory traversal vulnerabilities in the FileBrowser components in Synology DiskStation Manager (DSM) before

CVE-2021-3156 HIGH POC
7.8 Jan 26

Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege
CVE-2018-8897 HIGH POC
7.8 May 08

A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) wa
CVE-2018-1160 CRITICAL POC
9.8 Dec 20

Netatalk before 3.1.12 is vulnerable to an out of bounds write in dsi_opensess.c. Rated critical severity (CVSS 9.8), th
CVE-2021-26566 CRITICAL POC
9.0 Feb 26

Insertion of sensitive information into sent data vulnerability in synorelayd in Synology DiskStation Manager (DSM) befo
CVE-2020-27648 CRITICAL POC
9.0 Oct 29

Improper certificate validation vulnerability in OpenVPN client in Synology DiskStation Manager (DSM) before 6.2.3-25426
CVE-2021-26564 HIGH POC
8.7 Feb 26

Cleartext transmission of sensitive information vulnerability in synorelayd in Synology DiskStation Manager (DSM) before

Same weakness CWE-913 – Improper Control of Dynamically-Managed Code Resources

View all
CVE-2023-43177 CRITICAL POC
9.8
CVE-2026-34156 CRITICAL POC
9.9
CVE-2023-29199 CRITICAL POC
10.0
CVE-2022-36067 CRITICAL POC
10.0
CVE-2023-29017 CRITICAL POC
9.8
CVE-2024-7297 HIGH POC
8.8
CVE-2019-1617 HIGH POC
7.4
CVE-2026-47208 CRITICAL
10.0

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2024-5401 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy