CVE-2024-5401: synology diskstation_manager
Vulnerability summary
CVE-2024-5401 is a high (CVSS 8.8) vulnerability in synology diskstation_manager. EPSS estimates a 0.38% chance of exploitation in the next 30 days, higher than 30.5% of scored vulnerabilities.
Timeline
- 04-12-2025PublishedVulnerability first disclosed.
- 04-12-2025Last modifiedVulnerability information updated.
Description
Improper control of dynamically-managed code resources vulnerability in WebAPI component in Synology DiskStation Manager (DSM) before 7.1.1-42962-8 and 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote authenticated users to obtain privileges without consent via unspecified vectors.
CVSS metrics
2 scores · 2 sources · 1 version- CVE.orgCNA4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:NDiffers
EPSS trend
Probability
0.38%
Chance of exploitation in the next 30 days
Percentile
31%
Versus all other CVEs
30-day change
0.00 pp
From 0.38% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Synology4 products
- diskstation_manager≥ 7.2.1-69057, < 7.2.1-69057-2 | ≥ 7.2.2-72803, < 7.2.2-72806
- diskstation manager (dsm)≥ 7.2.2, < 7.2.2-72806 | ≥ 7.2.1, < 7.2.1-69057-2
- diskstation_manager_unified_controller≥ 3.1-23028, < 3.1.4-23079
- unified controller (dsmuc)≥ 3.1, < 3.1.4-23079
1 vendor · 4 products