CVE-2024-10444 - Vulnerability Details - OpenCVE

Improper certificate validation vulnerability in the LDAP utilities in Synology DiskStation Manager (DSM) before 7.1.1-42962-8, 7.2.1-69057-7 and 7.2.2-72806-3 allows man-in-the-middle attackers to hijack the authentication of administrators via unspecified vectors.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00035.

Exploitation none

Automatable no

Technical Impact total

No data.

No data.

No data.

No data.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://www.synology.com/en-global/security/advisory/Synology_SA_25_01

History

Wed, 19 Mar 2025 14:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Wed, 19 Mar 2025 02:15:00 +0000

Type	Values Removed	Values Added
Description		Improper certificate validation vulnerability in the LDAP utilities in Synology DiskStation Manager (DSM) before 7.1.1-42962-8, 7.2.1-69057-7 and 7.2.2-72806-3 allows man-in-the-middle attackers to hijack the authentication of administrators via unspecified vectors.
Weaknesses		CWE-295
References		https://www.synology.com/en-global/security/advisory/Synology_SA_25_01
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: synology

Published: 2025-03-19T02:07:02.228Z

Updated: 2025-03-19T13:49:59.097Z

Reserved: 2024-10-28T02:37:19.911Z

Link: CVE-2024-10444

Vulnrichment

Updated: 2025-03-19T13:49:54.749Z

NVD

Status : Received

Published: 2025-03-19T02:15:28.297

Modified: 2025-03-19T02:15:28.297

Link: CVE-2024-10444

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-10444", "assignerOrgId": "db201096-a0cc-46c7-9a55-61d9e221bf01", "state": "PUBLISHED", "assignerShortName": "synology", "dateReserved": "2024-10-28T02:37:19.911Z", "datePublished": "2025-03-19T02:07:02.228Z", "dateUpdated": "2025-03-19T13:49:59.097Z"}, "containers": {"cna": {"problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Certificate Validation", "cweId": "CWE-295", "type": "CWE"}]}], "affected": [{"vendor": "Synology", "product": "DiskStation Manager (DSM)", "versions": [{"version": "7.2.2", "status": "affected", "lessThan": "7.2.2-72806-3", "versionType": "semver"}, {"version": "7.2.1", "status": "affected", "lessThan": "7.2.1-69057-7", "versionType": "semver"}, {"version": "7.1", "status": "affected", "lessThan": "7.1.1-42962-8", "versionType": "semver"}, {"version": "0", "status": "unknown", "lessThan": "7.1", "versionType": "semver"}], "defaultStatus": "affected"}], "descriptions": [{"lang": "en", "value": "Improper certificate validation vulnerability in the LDAP utilities in Synology DiskStation Manager (DSM) before 7.1.1-42962-8, 7.2.1-69057-7 and 7.2.2-72806-3 allows man-in-the-middle attackers to hijack the authentication of administrators via unspecified vectors."}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "version": "3.1"}}], "references": [{"url": "https://www.synology.com/en-global/security/advisory/Synology_SA_25_01", "name": "Synology-SA-25:01 DSM (PWN2OWN 2024)", "tags": ["vendor-advisory"]}], "credits": [{"lang": "en", "value": "Chris Anastasio (@mufinnnnnnn)", "type": "finder"}, {"lang": "en", "value": "Fabius Watson (@FabiusArtrel)", "type": "finder"}], "providerMetadata": {"orgId": "db201096-a0cc-46c7-9a55-61d9e221bf01", "shortName": "synology", "dateUpdated": "2025-03-19T02:07:26.900Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-03-19T13:49:51.324762Z", "id": "CVE-2024-10444", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-19T13:49:59.097Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-10444", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-03-19T13:49:51.324762Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-19T13:49:54.749Z"}}], "cna": {"credits": [{"lang": "en", "type": "finder", "value": "Chris Anastasio (@mufinnnnnnn)"}, {"lang": "en", "type": "finder", "value": "Fabius Watson (@FabiusArtrel)"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Synology", "product": "DiskStation Manager (DSM)", "versions": [{"status": "affected", "version": "7.2.2", "lessThan": "7.2.2-72806-3", "versionType": "semver"}, {"status": "affected", "version": "7.2.1", "lessThan": "7.2.1-69057-7", "versionType": "semver"}, {"status": "affected", "version": "7.1", "lessThan": "7.1.1-42962-8", "versionType": "semver"}, {"status": "unknown", "version": "0", "lessThan": "7.1", "versionType": "semver"}], "defaultStatus": "affected"}], "references": [{"url": "https://www.synology.com/en-global/security/advisory/Synology_SA_25_01", "name": "Synology-SA-25:01 DSM (PWN2OWN 2024)", "tags": ["vendor-advisory"]}], "descriptions": [{"lang": "en", "value": "Improper certificate validation vulnerability in the LDAP utilities in Synology DiskStation Manager (DSM) before 7.1.1-42962-8, 7.2.1-69057-7 and 7.2.2-72806-3 allows man-in-the-middle attackers to hijack the authentication of administrators via unspecified vectors."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-295", "description": "Improper Certificate Validation"}]}], "providerMetadata": {"orgId": "db201096-a0cc-46c7-9a55-61d9e221bf01", "shortName": "synology", "dateUpdated": "2025-03-19T02:07:26.900Z"}}}, "cveMetadata": {"cveId": "CVE-2024-10444", "state": "PUBLISHED", "dateUpdated": "2025-03-19T13:49:59.097Z", "dateReserved": "2024-10-28T02:37:19.911Z", "assignerOrgId": "db201096-a0cc-46c7-9a55-61d9e221bf01", "datePublished": "2025-03-19T02:07:02.228Z", "assignerShortName": "synology"}, "dataVersion": "5.1"}