CVE-2024-50629: Improper encoding or escaping of output vulnerability in the webapi component in Synology BeeStation OS (BSM) before 1.1-65374 and Synology DiskStation Manager…

PriorityP344medium5.3CVSS 3.1

AVNACLPRNUINSUCLINAN

EPSS

26.95%

97.8th percentile

Improper encoding or escaping of output vulnerability in the webapi component in Synology BeeStation OS (BSM) before 1.1-65374 and Synology DiskStation Manager (DSM) before 7.1.1-42962-7, 7.2-64570-4, 7.2.1-69057-6 and 7.2.2-72806-1 allow remote attackers to read limited files via unspecified vectors.

Affected

11 ranges

Vendor	Product	Version range	Fixed in
synology	beestation_os	—	—
synology	beestation_os	—	—
synology	beestation_os	—	—
synology	beestation_os	—	—
synology	beestation_os	>= 1.0 < 1.1-65374	1.1-65374
synology	beestation_os	>= 1.1 < 1.1-65374	1.1-65374
synology	diskstation_manager	>= 7.1 < 7.1.1-42962-7	7.1.1-42962-7
synology	diskstation_manager	>= 7.2 < 7.2-64570-4	7.2-64570-4
synology	diskstation_manager	>= 7.2.1 < 7.2.1-69057-6	7.2.1-69057-6
synology	diskstation_manager	>= 7.2.1-69057 < 7.2.1-69057-6	7.2.1-69057-6
synology	diskstation_manager	>= 7.2.2 < 7.2.2-72806-1	7.2.2-72806-1

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

Suricata

ET EXPLOIT Synology Driver Server SQL Injection (CVE-2024-50631)

suricata·2025-12-16·CVSS 5.3

CVE-2024-50631 [MEDIUM] ET EXPLOIT Synology Driver Server SQL Injection (CVE-2024-50631) ET EXPLOIT Synology Driver Server SQL Injection (CVE-2024-50631) Rule: alert tcp any any -> $HOME_NET 6690 (msg:"ET EXPLOIT Synology Driver Server SQL Injection (CVE-2024-50631)"; flow:established,to_server; content:"|25 52 18 14 46 12 00 00 42|"; startswith; content:"|10 00 1a|sharing_link_customization|10 00|"; fast_pattern; pcre:"/^.{1,20}[\x27\x22\x3b\x2d\x5c\x2a\x2f]/R"; reference:url,github.com/kiddo-pwn/CVE-2024-50629_50631; reference:cve,2024-50631; classtype:bad-unknown; sid:2066335; rev:1; metadata:affected_product Synology, attack_target Server, created_at 2025_12_16, cve CVE_2024_50631, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag Exploit, updated_at 2025_12_16, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_techniq

Suricata

ET WEB_SPECIFIC_APPS Synology Driver Server CRLF Injection (CVE-2024-50629)

suricata·2025-12-05·CVSS 5.3

CVE-2024-50629 [MEDIUM] ET WEB_SPECIFIC_APPS Synology Driver Server CRLF Injection (CVE-2024-50629) ET WEB_SPECIFIC_APPS Synology Driver Server CRLF Injection (CVE-2024-50629) Rule: alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Synology Driver Server CRLF Injection (CVE-2024-50629)"; flow:established,to_server; http.uri; content:"/webapi/entry.cgi"; startswith; http.request_body; content:"api|3d|SYNO.API.Auth.RedirectURI"; fast_pattern; content:"redirect_url|3d|"; pcre:"/^[^&]*?\x25(?:25)?0[dD]\x25(?:25)?0[aA]/R"; reference:url,kiddo-pwn.github.io/blog/2025-11-30/writing-sync-popping-cron; reference:cve,2024-50629; classtype:web-application-attack; sid:2066036; rev:1; metadata:affected_product Synology, attack_target Server, tls_state TLSDecrypt, created_at 2025_12_05, cve CVE_2024_50629, deployment Perimeter, deployment Internal, deployment SSLDecrypt, confidence High,