« Volver al listado

CVE-2024-45538

Estado: AnalizadaCrítica (9.6)—

Cross-Site Request Forgery (CSRF) vulnerability in WebAPI Framework in Synology DiskStation Manager (DSM) before 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote attackers to execute arbitrary code via unspecified vectors.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

CSRF (CWE-352) con UI:R requiere interacción del usuario (hacer clic en enlace malicioso). El vector remoto y ejecución de código arbitrario indican compromiso completo; T1059 por ejecución de código, T1565.001 como impacto secundario por manipulación posible de datos en el sistema.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Restrict Web-Based ContentPrivileged Account ManagementLimit Software InstallationExecution PreventionBehavior Prevention on EndpointDisable or Remove Feature or Program

Tecnologías afectadas (2)

Synology — Diskstation ManagerSynology — Diskstation Manager Unified Controller

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-45538",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-45538",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-12-04T19:13:52.403109Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@synology.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 9.6,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@synology.com",
      "affectedData": [
        {
          "vendor": "Synology",
          "product": "DiskStation Manager (DSM)",
          "versions": [
            {
              "status": "affected",
              "version": "7.2.2",
              "lessThan": "7.2.2-72806",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "7.2.1",
              "lessThan": "7.2.1-69057-2",
              "versionType": "semver"
            },
            {
              "status": "unknown",
              "version": "0",
              "lessThan": "7.2.1",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "affected"
        },
        {
          "vendor": "Synology",
          "product": "Unified Controller (DSMUC)",
          "versions": [
            {
              "status": "affected",
              "version": "3.1",
              "lessThan": "3.1.4-23079",
              "versionType": "semver"
            },
            {
              "status": "unknown",
              "version": "0",
              "lessThan": "3.1",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2025-12-04T15:15:54.290",
  "references": [
    {
      "url": "https://www.synology.com/en-global/security/advisory/Synology_SA_24_27",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@synology.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@synology.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-Site Request Forgery (CSRF) vulnerability in WebAPI Framework in Synology DiskStation Manager (DSM) before 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote attackers to execute arbitrary code via unspecified vectors."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de Cross-Site Request Forgery (CSRF) en el framework WebAPI en Synology DiskStation Manager (DSM) antes de 7.2.1-69057-2 y 7.2.2-72806 y Synology Unified Controller (DSMUC) antes de 3.1.4-23079 permite a atacantes remotos ejecutar código arbitrario a través de vectores no especificados."
    }
  ],
  "lastModified": "2026-09-26T21:10:00.130",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:synology:diskstation_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8A71CCD8-D16A-482E-80AC-B0E7E93591E2",
              "versionEndExcluding": "7.2.1-69057-2",
              "versionStartIncluding": "7.2.1-69057"
            },
            {
              "criteria": "cpe:2.3:o:synology:diskstation_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E954B1FD-7E72-41F6-A80A-C1EEB30F0A54",
              "versionEndExcluding": "7.2.2-72806",
              "versionStartIncluding": "7.2.2-72803"
            },
            {
              "criteria": "cpe:2.3:o:synology:diskstation_manager_unified_controller:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6BAB44D0-881B-4177-BCE2-04C0CEF17C38",
              "versionEndExcluding": "3.1.4-23079",
              "versionStartIncluding": "3.1-23028"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@synology.com"
}