Cross-Site Request Forgery (CSRF) vulnerability in WebAPI Framework in Synology DiskStation Manager (DSM) before 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote attackers to execute arbitrary code via unspecified vectors.
References
| Link | Resource |
|---|---|
| https://www.synology.com/en-global/security/advisory/Synology_SA_24_27 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
05 Dec 2025, 21:44
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://www.synology.com/en-global/security/advisory/Synology_SA_24_27 - Vendor Advisory | |
| First Time |
Synology
Synology diskstation Manager Synology diskstation Manager Unified Controller |
|
| CPE | cpe:2.3:o:synology:diskstation_manager:*:*:*:*:*:*:*:* cpe:2.3:o:synology:diskstation_manager_unified_controller:*:*:*:*:*:*:*:* |
04 Dec 2025, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-12-04 15:15
Updated : 2025-12-05 21:44
NVD link : CVE-2024-45538
Mitre link : CVE-2024-45538
CVE.ORG link : CVE-2024-45538
JSON object : View
Products Affected
synology
- diskstation_manager
- diskstation_manager_unified_controller
CWE
CWE-352
Cross-Site Request Forgery (CSRF)