CVE-2024-45538

critical · 9.6

Cross-Site Request Forgery (CSRF) vulnerability in WebAPI Framework in Synology DiskStation Manager (DSM) before 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote attackers to execute arbitrary code via unspecified vectors.

9.6

CVSS

0.4%

EPSS (exploit prob.)

31st

EPSS percentile

2025-12-04

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weaknesses

CWE-352

Affected products

Vendor	Product	Affected versions
synology	diskstation_manager	>= 7.2.1-69057, < 7.2.1-69057-2
synology	diskstation_manager	>= 7.2.2-72803, < 7.2.2-72806
synology	diskstation_manager_unified_controller	>= 3.1-23028, < 3.1.4-23079

Check a specific version with /api/v1/cve/match.

References

https://www.synology.com/en-global/security/advisory/Synology_SA_24_27

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2024-45538