CVE-2024-10443 is a critical OS Command Injection vulnerability affecting Synology BeePhotos (before 1.0.2-10026 and 1.1.0-10053) and Synology Photos (before 1.6.2-0720 and 1.7.0-0795), allowing remote attackers to execute arbitrary code. With a CVSS score of 9.8 (Critical), this vulnerability is easily exploitable over the network with no authentication or user interaction required, leading to complete compromise of confidentiality, integrity, and availability. While not yet in CISA's KEV catalog, it has been exploited in the wild at Pwn2Own, has a high EPSS score, and has publicly available Nuclei templates, indicating a high likelihood of active exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 1.6.2-0720CPE matchmatch criteria | cpe:2.3:a:synology:photos:*:*:*:*:*:diskstation_manager:*:* | ||
< 1.1.0-10053CPE matchmatch criteria | cpe:2.3:a:synology:beephotos:*:*:*:*:*:beestation_os:*:* | ||
< 1.0.2-10026CPE matchmatch criteria | cpe:2.3:a:synology:beephotos:*:*:*:*:*:beestation_os:*:* | ||
< 1.7.0-0795CPE matchmatch criteria | cpe:2.3:a:synology:photos:*:*:*:*:*:diskstation_manager:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.