CVE-2024-10441

Name of the Vulnerable Software and Affected Versions Synology BeeStation Manager (BSM) versions prior to 1.1-65374 Synology DiskStation Manager (DSM) versions prior to 6.2.4-25556-8 Synology DiskStation Manager (DSM) versions prior to 7.1.1-42962-7 Synology DiskStation Manager (DSM) versions prior to 7.2-64570-4 Synology DiskStation Manager (DSM) versions prior to 7.2.1-69057-6 Synology DiskStation Manager (DSM) versions prior to 7.2.2-72806-1 Synology Unified Controller (DSMUC) versions prior to 3.1.4-23079

Description An improper encoding or escaping of output issue exists in the system plugin daemon. This flaw allows unauthenticated remote attackers to execute arbitrary code via unspecified vectors. Technical analysis indicates that user-controlled data can affect the environment passed to privileged plugin processes, enabling command execution. In real-world incidents, this has been exploited to deploy C3RB3R ransomware, which encrypts files with a .L0CK3D extension and leaves read-me3.txt ransom notes. Exploitation involves sending a crafted request to the /webapi/entry.cgi endpoint using the account parameter to inject environment variables such as LD PRELOAD and LD DEBUG OUTPUT to trigger the execution of a remote shell script.

Recommendations Update Synology BeeStation Manager (BSM) to version 1.1-65374 or later. Update Synology DiskStation Manager (DSM) to version 6.2.4-25556-8 or later. Update Synology DiskStation Manager (DSM) to version 7.1.1-42962-7 or later. Update Synology DiskStation Manager (DSM) to version 7.2-64570-4 or later. Update Synology DiskStation Manager (DSM) to version 7.2.1-69057-6 or later. Update Synology DiskStation Manager (DSM) to version 7.2.2-72806-1 or later. Update Synology Unified Controller (DSMUC) to version 3.1.4-23079 or later. Restrict access to the /webapi/entry.cgi endpoint from the internet to minimize the risk of remote exploitation.