CVE-2024-10443

Published Nov 15, 2024

Last updated a month ago

CVSS critical 9.8

Overview

Description: Improper neutralization of special elements used in a command ('Command Injection') vulnerability in Task Manager component in Synology BeePhotos before 1.0.2-10026 and 1.1.0-10053 and Synology Photos before 1.6.2-0720 and 1.7.0-0795 allows remote attackers to execute arbitrary code via unspecified vectors.
Source: security@synology.com
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

security@synology.com: CWE-77

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:synology:photos:*:*:*:*:*:diskstation_manager:*:*",
            "vulnerable": true,
            "matchCriteriaId": "419F75B4-D207-4288-8497-4B3A8C583E46",
            "versionEndExcluding": "1.6.2-0720"
          }
        ],
        "operator": "OR"
      },
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:synology:diskstation_manager:7.2:*:*:*:*:*:*:*",
            "vulnerable": false,
            "matchCriteriaId": "5C262042-304B-49DC-BB4B-655C5C36D88C"
          }
        ],
        "operator": "OR"
      }
    ],
    "operator": "AND"
  },
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:synology:beephotos:*:*:*:*:*:beestation_os:*:*",
            "vulnerable": true,
            "matchCriteriaId": "47E33443-30C1-42A0-8876-405FD9AC155A",
            "versionEndExcluding": "1.1.0-10053"
          }
        ],
        "operator": "OR"
      },
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:synology:beestation_os:1.1:*:*:*:*:*:*:*",
            "vulnerable": false,
            "matchCriteriaId": "E456DD53-9402-48F7-98F8-8CEE480D8337"
          }
        ],
        "operator": "OR"
      }
    ],
    "operator": "AND"
  },
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:synology:beephotos:*:*:*:*:*:beestation_os:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A8BA8374-E7BE-406B-82E8-5EDBED2551EF",
            "versionEndExcluding": "1.0.2-10026"
          }
        ],
        "operator": "OR"
      },
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:synology:beestation_os:1.0:*:*:*:*:*:*:*",
            "vulnerable": false,
            "matchCriteriaId": "DCDD1FA9-719E-4C69-9D72-29B154E27849"
          }
        ],
        "operator": "OR"
      }
    ],
    "operator": "AND"
  },
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:synology:photos:*:*:*:*:*:diskstation_manager:*:*",
            "vulnerable": true,
            "matchCriteriaId": "71B932C6-C930-4C9A-9C75-CFEAFB41BD24",
            "versionEndExcluding": "1.7.0-0795"
          }
        ],
        "operator": "OR"
      },
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:synology:diskstation_manager:7.2.2:*:*:*:*:*:*:*",
            "vulnerable": false,
            "matchCriteriaId": "4E22F435-F709-495B-84B4-A478C63331B9"
          }
        ],
        "operator": "OR"
      }
    ],
    "operator": "AND"
  }
]

Overview

Risk scores

CVSS 3.1

Weaknesses

Social media

Configurations

References