ZDI-CAN-25403: ZDI-25-214: (Pwn2Own) Synology DiskStation DS1823xs+ Vue.JS Improper Neutralization of Argument Delimiters Remote Code Execution Vulnerability

Published Apr 9, 2025

Updated

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Synology DiskStation DS1823xs+ devices. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2024-10441.

Affected Software

1 affected component

Synology DiskStation DS1823xs+

Event History

Apr 9, 2025

Advisory Published

via ZDI·05:00 AM

Data Sourced

via ZDI·05:00 AM

Description

Frequently Asked Questions

What is the severity of ZDI-CAN-25403?

The severity of ZDI-CAN-25403 is rated at 8.8 on the CVSS scale.

How do I fix ZDI-CAN-25403?

To fix ZDI-CAN-25403, ensure that your Synology DiskStation DS1823xs+ devices are updated to the latest firmware version provided by Synology.

Who is affected by ZDI-CAN-25403?

The vulnerability ZDI-CAN-25403 affects installations of Synology DiskStation DS1823xs+ devices.

Is authentication required to exploit ZDI-CAN-25403?

No, authentication is not required to exploit ZDI-CAN-25403.

What type of attack does ZDI-CAN-25403 enable?

ZDI-CAN-25403 allows network-adjacent attackers to execute arbitrary code on affected devices.