ZDI-CAN-25607: ZDI-25-208: (Pwn2Own) Synology DiskStation DS1823xs+ Replication Service Out-Of-Bounds Write Remote Code Execution Vulnerability

Published Apr 9, 2025

Updated

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Synology DiskStation DS1823xs+ devices. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.5. The following CVEs are assigned: CVE-2024-10442.

Affected Software

1 affected component

Synology DiskStation DS1823xs+

Event History

Apr 9, 2025

Advisory Published

via ZDI·05:00 AM

Data Sourced

via ZDI·05:00 AM

Description

Frequently Asked Questions

What is the severity of ZDI-CAN-25607?

ZDI-CAN-25607 has a CVSS rating of 7.5, indicating a high severity level.

How do I fix ZDI-CAN-25607?

To mitigate ZDI-CAN-25607, ensure that the affected Synology DiskStation DS1823xs+ devices are updated to the latest firmware version provided by Synology.

Who is affected by ZDI-CAN-25607?

The vulnerability ZDI-CAN-25607 affects users of Synology DiskStation DS1823xs+ devices.

Can ZDI-CAN-25607 be exploited remotely?

Yes, ZDI-CAN-25607 can be exploited by network-adjacent attackers without requiring authentication.

What type of vulnerability is ZDI-CAN-25607?

ZDI-CAN-25607 allows for the execution of arbitrary code on the affected devices.