CVE-2024-5401

highpriority · track · 35EPSS 0.004 · 32 %ileEUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.38% (32nd) EPSS

CVSS 8.8 · high

Is it mine?

6 products

Check your exposure

Who says so?

3 sources

cnnvd · enisa_euvd · nvd

EPSS · scored 2026-10-27

Improper control of dynamically-managed code resources vulnerability in WebAPI component in Synology DiskStation Manager (DSM) before 7.1.1-42962-8 and 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote authenticated users to obtain privileges without consent via unspecified vectors.

cvss

Technical severity, 0–10. One row per scoring source.

8.8

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 4.3–8.8

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 2.8 · impact 5.9

v3.14.3mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:Nsecondary · ENISA EU

v3.14.3mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:Nsecondary · security@synology.comexploitability 2.8 · impact 1.4

v3.18.1highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-913US

affected products (6)

Products and version ranges known to be affected.

Synology DiskStation Manager (DSM)7.2.1 → 7.2.1-69057-2enisa_euvdEU
Synology DiskStation Manager (DSM)7.2.2 → 7.2.2-72806enisa_euvdEU
Synology Unified Controller (DSMUC)3.1 → 3.1.4-23079enisa_euvdEU
synology diskstation manager7.2.1-69057 → 7.2.1-69057-2nvdUScpe:2.3:o:synology:diskstation_manager:*:*:*:*:*:*:*:*
synology diskstation manager7.2.2-72803 → 7.2.2-72806nvdUScpe:2.3:o:synology:diskstation_manager:*:*:*:*:*:*:*:*
synology diskstation manager unified controller3.1-23028 → 3.1.4-23079nvdUScpe:2.3:o:synology:diskstation_manager_unified_controller:*:*:*:*:*:*:*:*

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd nvd NVD CVE.org MITRE

published 2025-12-04modified 2026-06-17

references (4)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan