CVE-2024-10441: Critical RCE in Synology DSM and BeeStation

Critical RCE (CVSS 9.8) in Synology DSM and BeeStation. Immediate patching required.

CVE-2024-10441 is an improper encoding/escaping vulnerability in the system plugin daemon of Synology DiskStation Manager (DSM) and BeeStation OS (BSM). The flaw allows remote attackers to execute arbitrary code through unspecified vectors, directly impacting storage, backup, and data management environments in organizations of all sizes.

The vulnerability is assigned CVSS 9.8 and classified as critical by Synology. NVD data confirms its existence with official description and specific vulnerable versions. A significant signal comes from the research community: public repositories declare containing scanners able to detect this flaw (in read-only mode without exploit execution), indicating researcher interest and potential spread of vulnerability knowledge.

Administrators and IT teams must update immediately: DSM to versions 7.2-64570-4 or later (7.2.1-69057-6, 7.2.2-72806-1), and BSM to 1.1-65374 or higher. Inventory Synology assets, apply patches urgently, and review recent remote access logs for exploitation signs. Rely on Synology for patches and official security communications.

At a glance

What: Improper encoding/escaping in system plugin daemon enables arbitrary remote code execution
Severity: CVSS 9.8 - Critical
Affected versions: DSM < 7.2-64570-4, < 7.2.1-69057-6, < 7.2.2-72806-1; BSM < 1.1-65374
Fix: Update to DSM 7.2-64570-4+, 7.2.1-69057-6+ or 7.2.2-72806-1+; BSM 1.1-65374+
Status: Published in NVD on 2025-03-19. Public detection scanner available in public repositories (read-only mode).
Action: Inventory Synology assets, apply patch immediately, review recent remote access logs for exploitation

Sources: NVD, CVE-2024-10441

← All articles