Cross-Site Request Forgery Vulnerability in Synology DiskStation Manager
CVE-2024-45538

9.6CRITICAL

Key Information:

Vendor

Synology
Status
Diskstation Manager (dsm)
Unified Controller (dsmuc)
Vendor
CVE Published:
4 December 2025

What is CVE-2024-45538?

A vulnerability exists in the WebAPI Framework of Synology DiskStation Manager that could allow remote attackers to perform unauthorized actions through Cross-Site Request Forgery. This flaw affects multiple versions of DSM and DSMUC, permitting attackers to execute arbitrary code via exploited vectors, which raises serious security concerns for device integrity and user data protection.

Affected Version(s)

DiskStation Manager (DSM) 7.2.2

DiskStation Manager (DSM) 7.2.2 < 7.2.2-72806

DiskStation Manager (DSM) 7.2.1 < 7.2.1-69057-2

References

https://www.synology.com/en-global/security/advisory/Syno...
vendor-advisory

CVSS V3.1

Score:
9.6
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Steven Lin ( https://x.com/5teven1in )
JSON
.
CVE-2024-45538 : Cross-Site Request Forgery Vulnerability in Synology DiskStation Manager