How severe is CVE-2024-5401?

CVE-2024-5401 has a CVSS 3.x base score of 4.3, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity low, and availability none.

Is CVE-2024-5401 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (25th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2024-5401?

CVE-2024-5401 primarily affects Synology Diskstation Manager. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2024-5401?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2024-5401 have an EU (EUVD) identifier?

Yes. CVE-2024-5401 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-55300.

When was CVE-2024-5401 published?

CVE-2024-5401 was published on 2025-12-04 and last updated on 2026-06-17.

CVE-2024-5401

CVE-2024-5401 is a medium-severity vulnerability in Synology Diskstation Manager with a CVSS 3.x base score of 4.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-913.

Key facts

Severity: Medium (CVSS 3.x base score 4.3)
EPSS exploit prediction: 0% (25th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2024-55300
Weakness: CWE-913
Affected product: Synology Diskstation Manager
Published: 2025-12-04
Last modified: 2026-06-17

Description

Improper control of dynamically-managed code resources vulnerability in WebAPI component in Synology DiskStation Manager (DSM) before 7.1.1-42962-8 and 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote authenticated users to obtain privileges without consent via unspecified vectors.

Frequently asked questions

What is CVE-2024-5401?: Improper control of dynamically-managed code resources vulnerability in WebAPI component in Synology DiskStation Manager (DSM) before 7.1.1-42962-8 and 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote authenticated users to obtain privileges without consent via unspecified vectors.
How severe is CVE-2024-5401?: CVE-2024-5401 has a CVSS 3.x base score of 4.3, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity low, and availability none.
Is CVE-2024-5401 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (25th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2024-5401?: CVE-2024-5401 primarily affects Synology Diskstation Manager. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2024-5401?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2024-5401 have an EU (EUVD) identifier?: Yes. CVE-2024-5401 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-55300.
When was CVE-2024-5401 published?: CVE-2024-5401 was published on 2025-12-04 and last updated on 2026-06-17.

References

https://www.synology.com/en-global/security/advisory/Synology_SA_24_27

Affected products (2)

cpe:2.3:o:synology:diskstation_manager:*:*:*:*:*:*:*:*
cpe:2.3:o:synology:diskstation_manager_unified_controller:*:*:*:*:*:*:*:*

More vulnerabilities in Synology Diskstation Manager

CVE-2022-27626 — Critical (CVSS 10.0): A vulnerability regarding concurrent execution using shared resource with improper synchronization ('Race Condition')…
CVE-2022-27625 — Critical (CVSS 10.0): A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the…
CVE-2022-27624 — Critical (CVSS 10.0): A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the…
CVE-2013-6955 — Critical (CVSS 10.0): webman/imageSelector.cgi in Synology DiskStation Manager (DSM) 4.0 before 4.0-2259, 4.2 before 4.2-3243, and 4.3 before…
CVE-2024-10441 — Critical (CVSS 9.8): Improper encoding or escaping of output vulnerability in the system plugin daemon in Synology BeeStation OS (BSM)…
CVE-2022-22687 — Critical (CVSS 9.8): Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in Authentication functionality in…

All CVEs affecting Synology Diskstation Manager →

Other CWE-913 vulnerabilities

CVE-2026-47208 — Critical (CVSS 10.0): vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, VM2 suffers from a sandbox breakout…
CVE-2026-47137 — Critical (CVSS 10.0): vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, the fix for GHSA-8hg8-63c5-gwmx (CVE-2023-37903)…
CVE-2026-47131 — Critical (CVSS 10.0): vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, by combining…
CVE-2023-29017 — Critical (CVSS 10.0): vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Prior to version 3.9.15, vm2 was…
CVE-2022-36067 — Critical (CVSS 10.0): vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. In versions prior to version…
CVE-2026-34156 — Critical (CVSS 9.9): NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior…

Browse all CWE-913 vulnerabilities →