CVE-2024-5401

HighCVSS 8.8/10Last modified Sep 26, 2026

Description

Improper control of dynamically-managed code resources vulnerability in WebAPI component in Synology DiskStation Manager (DSM) before 7.1.1-42962-8 and 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote authenticated users to obtain privileges without consent via unspecified vectors.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-913

Affected software

No affected versions have been published.

Timeline

Published: Dec 4, 2025
Last modified: Sep 26, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-540103.4A vulnerability in the firewall component of HPE Aruba Networking CX 10000 Series Switches exists. It could allow an unauthenticated adjace CVE-2024-540116.5Penetration Testing engineers at Amazon have discovered a flaw where the camera system fails to properly handle data supplied in certain req CVE-2024-540125.3Penetration Testing engineers at Amazon discovered a vulnerability where the camera system failed to properly validate input, allowing speci CVE-2024-540138.8Penetration Testing engineers at Amazon have identified a security flaw related to request handling in the web server component that could, CVE-2024-540143.6Improper authorization in handler for custom URL scheme issue in 'Skylark' App for Android 6.2.13 and earlier and 'Skylark' App for iOS 6.2.CVE-2024-540157.5A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions < V9.90), SIPROTEC 5 6MD85 (CP300) (All versions >= V8.80 < V9 CVE-2024-540164.3Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Seata (incubating). This issue affects Apache Seat CVE-2024-540175.3A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions < V11.0), SIPROTEC 5 6MD85 (CP200) (All versions), SIPROTEC 5 CVE-2024-540187.2Multiple improper neutralization of special elements used in an OS Command vulnerabilities [CWE-78] in FortiSandbox before 4.4.5 allows a pr CVE-2024-540196.5A improper validation of certificate with host mismatch in Fortinet FortiClientWindows version 7.4.0, versions 7.2.0 through 7.2.6, and 7.0 CVE-2024-54027.8Unquoted Search Path or Element vulnerability in ABB Mint Workbench. A local attacker who successfully exploited this vulnerability could CVE-2024-540204.3A missing authorization in Fortinet FortiManager versions 7.2.0 through 7.2.1, and versions 7.0.0 through 7.0.7 may allow an authenticated a