01 · The Real Story
A library that hands a stranger one page from a locked filing cabinet through the book-return slot
CVE-2024-50629 is an improper output encoding or escaping flaw in Synology’s webapi component. A remote attacker can send a crafted request and read a limited set of files from a vulnerable BeeStation OS or DiskStation Manager device without authenticating. Affected versions are BSM before 1.1-65374 and DSM before 7.1.1-42962-7, 7.2-64570-4, 7.2.1-69057-6, and 7.2.2-72806-1.
The vendor rates this Medium with CVSS 5.3, and that is broadly fair: confidentiality impact is low (limited file read), with no integrity or availability impact. However, in deployments where DSM acts as a file server or backup target holding sensitive data, a limited unauthenticated read can still expose configuration or PII. We keep the verdict Medium, but encourage defenders to treat exposed internet-facing Synology web UIs as a meaningful attack surface.
"Unauthenticated remote file read on Synology DSM/BSM webapi is real, but it's limited—Medium holds unless your NAS holds the crown jewels."
02 · The Attack Path
3 steps from start to impact.
STEP 01
Locate a reachable vulnerable DSM/BSM webapi endpoint
The attacker identifies a Synology device reachable on the network, often via direct exposure on TCP 5000/5001 or through Synology QuickConnect relay. The webapi component is reachable without prior authentication.
Conditions required:
- Network path to DSM/BSM web UI or QuickConnect
- Vulnerable DSM/BSM version installed
Where this breaks in practice:
- Many enterprise DSM units are internal-only or behind VPN, reducing external exposure
- QuickConnect can expose home/SMB units, but enterprise fleets often disable it
Detection/coverage: Shodan/Censys can identify exposed Synology portals; Check Point IPS CPAI-2024-3253 logs or blocks malicious webapi requests.
STEP 02
Send crafted webapi request to exploit output encoding flaw
The attacker sends a crafted HTTP request to a vulnerable webapi endpoint. Because output is not properly encoded or escaped, the response includes file contents that should not be returned.
Conditions required:
- Ability to reach the vulnerable webapi endpoint
- No authentication requirement on the affected path
Where this breaks in practice:
- Exact vulnerable endpoint and vector are unspecified; no public PoC is available
- The flaw is limited to selected files, not arbitrary read
Detection/coverage: Check Point IPS CPAI-2024-3253 can detect and block the crafted request; DSM webapi access logs may show abnormal requests if enabled.
STEP 03
Read limited files from the NAS
The attacker obtains the contents of a limited set of files from the device. The exact files depend on the webapi context, but may include configuration or system file content.
Conditions required:
- Vulnerable webapi path returns a file that contains useful data
- Attacker knows or guesses the file path/parameter
Where this breaks in practice:
- Not an arbitrary file read; scope is limited by the vulnerable endpoint
- If the NAS stores low-sensitivity media, the leaked data may be of little value
Detection/coverage: DSM file access auditing or a SIEM correlation on webapi logs can flag unusual reads if logging is enabled.
03 · Compensating Control
1
MEDIUM 5.3→IGNORE 0.0
SEVERITY REDUCEDApply the Synology vendor patch to BSM 1.1-65374 or the fixed DSM versions — This is the actual fix and eliminates the vulnerable webapi encoding path. Deploy within 365 days per the noisgate remediation SLA for Medium; do not wait for the last day if the NAS holds sensitive data.
2
MEDIUM 5.3→LOW 3.5
SEVERITY REDUCEDRestrict DSM/BSM web UI access to a trusted management network or VPN and disable unnecessary QuickConnect — Removing internet exposure breaks the most common remote unauthenticated path. With only internal network access remaining, the practical residual risk drops to Low because an attacker must already have network adjacence. No formal noisgate mitigation SLA applies at Medium, but this is a sensible hardening step during the next change window.
3
MEDIUM 5.3→MEDIUM 5.3
Enable Check Point IPS signature CPAI-2024-3253 or an equivalent WAF rule if available — This can detect and block crafted webapi requests at the network edge. It does not fix the underlying flaw, so bypassing the IPS returns the original risk. Use as a temporary compensating control while patching is scheduled.
What doesn't work
- Changing the default HTTP/HTTPS ports does not stop the webapi output encoding flaw; it only obscures the target from casual scans.
- Requiring DSM user MFA does not help because the vulnerable webapi path is reachable pre-auth.
- Disabling SMB/NFS file sharing does not mitigate the issue because the flaw is in the webapi component, not file-sharing protocols.
- Isolating the NAS on a separate VLAN reduces exposure but does not fix the vulnerability if an attacker already has internal network access.
04 · Intelligence Metadata
The supporting signals.
| In-the-wild status | No confirmed active exploitation; not listed in CISA KEV. |
|---|---|
| Proof-of-concept availability | No public PoC found for this exact CVE in GitHub/pocindex or security advisories; Check Point IPS has a signature but no public exploit. |
| EPSS score | 0.31942 |
| EPSS percentile | Not published; the score is elevated but must be interpreted against the absence of public PoC and KEV listing. |
| KEV status | Not in CISA Known Exploited Vulnerabilities catalog. |
| CVSS vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N → 5.3 Medium |
| Affected versions | BSM before 1.1-65374; DSM before 7.1.1-42962-7, 7.2-64570-4, 7.2.1-69057-6, 7.2.2-72806-1. |
| Fixed versions | BSM 1.1-65374; DSM 7.1.1-42962-7, 7.2-64570-4, 7.2.1-69057-6, 7.2.2-72806-1. |
| Exposure/scanning | No GreyNoise/Shodan exposure counts supplied in advisory; exposed DSM web UIs are common in SMB and remote-work environments. |
| Reported by | Synology via Pwn2Own 2024; disclosed 2025-03-19. |
Sources.
05 · The Call
Final Verdict
= UNCHANGED to MEDIUM (5.3/10)
Why this verdict
- Remote unauthenticated path: the webapi endpoint is network-reachable without credentials, so the base CVSS 5.3 for low-confidentiality read is justified.
- Friction audit: no public PoC or known exploitation lowers real-world urgency, but the vulnerability does not require prior compromise or user interaction.
- Role multiplier: low-value role (home lab/personal NAS) → local limited file read, minor impact. Typical SMB/departmental file NAS → local file read, moderate if sensitive data. Backup/BCDR role → possible limited recovery-metadata or config exposure, but no mass data egress, no domain/fleet/supply-chain pivot. The documented chain succeeds in these roles but the outcome is limited file disclosure, so the verdict is not floored to HIGH or CRITICAL.
Why not higher?
The flaw does not provide code execution, privilege escalation, authentication bypass, or arbitrary file read. The vendor’s CVSS low confidentiality impact matches the limited scope, and there is no evidence of a high-value-role takeover or mass data egress. A High or Critical rating would overstate the worst plausible outcome.
Why not lower?
It is remotely reachable, unauthenticated, and has low attack complexity. A vulnerable DSM/BSM in a data-storage or backup role can leak selected file contents to an unauthenticated attacker, so Low would ignore the realistic exposure of Synology web UIs.
06 · Verification
Crowdsourced verification payload.
Run this on the Synology NAS via SSH as an admin user, or from an auditor workstation with SSH access to the NAS. Copy the script to the host, then invoke: bash check_CVE-2024-50629.sh. It reads /etc.defaults/VERSION and exits 0 for PATCHED, 1 for VULNERABLE, 3 for UNKNOWN.
#!/bin/bash
VERSION_FILE="/etc.defaults/VERSION"
if [ ! -f "$VERSION_FILE" ]; then
echo "UNKNOWN: $VERSION_FILE not found"
exit 3
fi
get() { grep "^$1=" "$VERSION_FILE" 2>/dev/null | head -1 | cut -d'"' -f2; }
PRODUCT=$(get productversion)
BUILD=$(get buildnumber)
SMALL=$(get smallfixnumber)
UNIQUE=$(get unique)
[ -z "$SMALL" ] && SMALL=0
echo "Detected product=$PRODUCT build=$BUILD smallfix=$SMALL unique=${UNIQUE:-none}"
ver_ge() {
local IFS=.
local v1=($1) v2=($2)
local i
for ((i=0; i<${#v1[@]} || i<${#v2[@]}; i++)); do
local a=${v1[$i]:-0}; local b=${v2[$i]:-0}
if [ "$a" -lt "$b" ]; then return 1; fi
if [ "$a" -gt "$b" ]; then return 0; fi
done
return 0
}
case "$PRODUCT" in
1.*)
if ver_ge "$PRODUCT" "1.1" && [ "$BUILD" -ge 65374 ]; then
echo "PATCHED"
exit 0
else
echo "VULNERABLE (BSM before 1.1-65374)"
exit 1
fi
;;
7.1.1)
if [ "$BUILD" -gt 42962 ] || { [ "$BUILD" -eq 42962 ] && [ "$SMALL" -ge 7 ]; }; then echo "PATCHED"; exit 0; else echo "VULNERABLE (DSM 7.1.1 before 7.1.1-42962-7)"; exit 1; fi
;;
7.2)
if [ "$BUILD" -gt 64570 ] || { [ "$BUILD" -eq 64570 ] && [ "$SMALL" -ge 4 ]; }; then echo "PATCHED"; exit 0; else echo "VULNERABLE (DSM 7.2 before 7.2-64570-4)"; exit 1; fi
;;
7.2.1)
if [ "$BUILD" -gt 69057 ] || { [ "$BUILD" -eq 69057 ] && [ "$SMALL" -ge 6 ]; }; then echo "PATCHED"; exit 0; else echo "VULNERABLE (DSM 7.2.1 before 7.2.1-69057-6)"; exit 1; fi
;;
7.2.2)
if [ "$BUILD" -gt 72806 ] || { [ "$BUILD" -eq 72806 ] && [ "$SMALL" -ge 1 ]; }; then echo "PATCHED"; exit 0; else echo "VULNERABLE (DSM 7.2.2 before 7.2.2-72806-1)"; exit 1; fi
;;
*)
echo "UNKNOWN: product $PRODUCT not recognized for CVE-2024-50629"
exit 3
;;
esac