CVE-2024-5401CWE-913

CVE-2024-5401

Medium · published December 4, 2025

CVSS v3.1
4.3
EPSS
0%
Percentile
30.9
In the wild
Unconfirmed
What it is

Improper control of dynamically-managed code resources vulnerability in WebAPI component in Synology DiskStation Manager (DSM) before 7.1.1-42962-8 and 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote authenticated users to obtain privileges without consent via unspecified vectors.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00381 · 30.9th percentile
Weakness
CWE-913 · Improper Control of Dynamically-Managed Code Resources
Published
2025-12-04T20:15Z
Affected products (3)
ProductVersionsFixed in
synology/diskstation_manager≥ 7.2.1-69057, < 7.2.1-69057-27.2.1-69057-2
synology/diskstation_manager≥ 7.2.2-72803, < 7.2.2-728067.2.2-72806
synology/diskstation_manager_unified_controller≥ 3.1-23028, < 3.1.4-230793.1.4-23079
References (1)
https://www.synology.com/en-global/security/advisory/Synology_SA_24_27 · [email protected]
EPSS history
Timeline
  • 04 DEC 14:20Z
    Improper control of dynamically-managed code resources vulnerability in WebAPI component in Synology DiskStation Manager (DSM) before 7.1.1-42962-8 and…
    cvelistv5