CVE-2024-45539

HighCVSS 7.5/10Last modified Sep 26, 2026

Description

Out-of-bounds write vulnerability in cgi components in Synology DiskStation Manager (DSM) before 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote attackers to conduct denial-of-service attacks via unspecified vectors.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
Synology	DiskStation Manager (DSM)	>= 7.2.2, < 7.2.2-72806; >= 7.2.1, < 7.2.1-69057-2
Synology	Unified Controller (DSMUC)	>= 3.1, < 3.1.4-23079

References

https://www.synology.com/en-global/security/advisory/Synology_SA_24_27Vendor Advisory

Timeline

Published: Dec 4, 2025
Last modified: Sep 26, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-45545.4Improper Input Validation vulnerability in OpenText NetIQ Access Manager leads to Cross-Site Scripting (XSS) attack. This issue affects Acce CVE-2024-455406.6Memory corruption while invoking IOCTL map buffer request from userspace.CVE-2024-455417.8Memory corruption when IOCTL call is invoked from user-space to read board data.CVE-2024-455427.8Memory corruption when IOCTL call is invoked from user-space to write board data to WLAN driver.CVE-2024-455436.6Memory corruption while accessing MSM channel map and mixer functions.CVE-2024-455446.6Memory corruption while processing IOCTL calls to add route entry in the HW.CVE-2024-455467.8Memory corruption while processing FIPS encryption or decryption IOCTL call invoked from user-space.CVE-2024-455477.8Memory corruption while processing IOCTL call invoked from user-space to verify non extension FIPS encryption and decryption functionality.CVE-2024-455487.8Memory corruption while processing FIPS encryption or decryption validation functionality IOCTL call.CVE-2024-455497.7Information disclosure while creating MQ channels.CVE-2024-45557.5Improper Privilege Management vulnerability in OpenText NetIQ Access Manager allows user account impersonation in specific scenario. This is CVE-2024-455507.8Memory corruption occurs when invoking any IOCTL-calling application that executes all MCDM driver IOCTL calls.