CVE-2024-45539

highpriority · track · 0EPSS 0.005 · 41 %ileEUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.48% (41st) EPSS

CVSS 7.5 · high

Is it mine?

6 products

Check your exposure

Who says so?

3 sources

cnnvd · enisa_euvd · nvd

EPSS · scored 2026-10-27

Out-of-bounds write vulnerability in cgi components in Synology DiskStation Manager (DSM) before 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote attackers to conduct denial-of-service attacks via unspecified vectors.

cvss

Technical severity, 0–10. One row per scoring source.

7.5

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.9–7.5

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · ENISA EU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · security@synology.comexploitability 3.9 · impact 3.6

v3.16.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-787US

affected products (6)

Products and version ranges known to be affected.

Synology DiskStation Manager (DSM)7.2.1 → 7.2.1-69057-2enisa_euvdEU
Synology DiskStation Manager (DSM)7.2.2 → 7.2.2-72806enisa_euvdEU
Synology Unified Controller (DSMUC)3.1 → 3.1.4-23079enisa_euvdEU
synology diskstation manager7.2.1-69057 → 7.2.1-69057-2nvdUScpe:2.3:o:synology:diskstation_manager:*:*:*:*:*:*:*:*
synology diskstation manager7.2.2-72803 → 7.2.2-72806nvdUScpe:2.3:o:synology:diskstation_manager:*:*:*:*:*:*:*:*
synology diskstation manager unified controller3.1-23028 → 3.1.4-23079nvdUScpe:2.3:o:synology:diskstation_manager_unified_controller:*:*:*:*:*:*:*:*

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd nvd NVD CVE.org MITRE

published 2025-12-04modified 2026-06-17

references (3)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan