ZDI-25-214: (Pwn2Own) Synology DiskStation DS1823xs+ Vue.JS Improper Neutralization of Argument Delimiters Remote Code Execution Vulnerability
Published Apr 9, 2025
·Updated
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Synology DiskStation DS1823xs+ devices. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2024-10441.
Affected Software
1 affected component
Synology DiskStation DS1823xs+
Event History
Apr 9, 2025
Advisory Published
via ZDI·05:00 AM
Data Sourced
via ZDI·05:00 AM
Description
Frequently Asked Questions
1
What is the severity of ZDI-25-214?
The vulnerability ZDI-25-214 has a CVSS rating of 8.8, indicating it is critical.
2
Who is affected by ZDI-25-214?
Devices affected by ZDI-25-214 include the Synology DiskStation DS1823xs+.
3
What can attackers do with ZDI-25-214?
Exploitation of ZDI-25-214 allows network-adjacent attackers to execute arbitrary code without authentication.
4
Do I need to be authenticated to exploit ZDI-25-214?
No, authentication is not required to exploit the ZDI-25-214 vulnerability.
5
How do I fix ZDI-25-214?
To mitigate ZDI-25-214, it is recommended to apply the latest firmware updates provided by Synology.