CVE-2024-10442

State: Published
Severity: 10.0 Critical
Published: Mar 19, 2025
Updated: Mar 19, 2025
Reserved: Oct 28, 2024

Description

Off-by-one error vulnerability in the transmission component in Synology Replication Service before 1.0.12-0066, 1.2.2-0353 and 1.3.0-0423 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote attackers to execute arbitrary code, potentially leading to a broader impact across the system via unspecified vectors.

Scores

CVSS	Score	Vector	Source
3.1	10.0 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H	synology

Weaknesses

CWE-193 Off-by-one Error

Affected Products

Product	Versions
Unified Controller (DSMUC)Synology	3.1 to before 3.1.4-23079Affected before 3.1Unknown
Replication ServiceSynology	before 1.2.2-0353Affected before 1.0.12-0066Affected before 1.3.0-0423Affected

References

Synology-SA-24:22 Replication Service (PWN2OWN 2024)vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.