Synology DiskStation Manager and Unified Controller Improper Control of Dynamically-Managed Code Resources Vulnerability Allowing Privilege Escalation

A vulnerability exists in the WebAPI component of Synology DiskStation Manager (DSM) versions prior to 7.1.1-42962-8, 7.2.1-69057-2, and 7.2.2-72806, as well as in Synology Unified Controller (DSMUC) versions prior to 3.1.4-23079. This vulnerability allows remote authenticated users to gain privileges without consent, through unspecified vectors.

Impact

Exploitation of this vulnerability could lead to unauthorized privilege escalation for remote authenticated users.

Remediation

Users can upgrade to Synology DiskStation Manager (DSM) versions 7.2.2-72806 or above, 7.2.1-69057-2 or above, and for Synology Unified Controller (DSMUC) version 3.1.4-23079 or above.