Cyber Posture

CVE-2024-50630

High

Published: 19 March 2025

Published
19 March 2025
Modified
16 January 2026
KEV Added
Patch
CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0302 86.7th percentile
Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may exploit software vulnerabilities in an attempt to collect credentials.

Security Summary

CVE-2024-50630 is a missing authentication for critical function vulnerability (CWE-306) in the webapi component of Synology Drive Server. It affects versions prior to 3.0.4-12699, 3.2.1-23280, 3.5.0-26085, and 3.5.1-26102. The vulnerability enables remote attackers to obtain administrator credentials via unspecified vectors. It carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), reflecting high confidentiality impact from network-based attacks with low complexity and no required privileges or user interaction.

Remote unauthenticated attackers can exploit this vulnerability over the network to access the webapi component and retrieve administrator credentials. Successful exploitation grants attackers sensitive authentication data, potentially enabling further unauthorized access, privilege escalation, or complete compromise of the Synology Drive Server environment.

Synology security advisory SA_24_21, available at https://www.synology.com/en-global/security/advisory/Synology_SA_24_21, provides details on mitigation, including patches that address the issue in the specified fixed versions of Synology Drive Server. Security practitioners should apply these updates promptly to vulnerable installations.

Details

CWE(s)
CWE-306

Affected Products

synology
drive server
≤ 3.0.4-12699 · ≤ 3.2.1-23280 · ≤ 3.5.0-26085

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1212 Exploitation for Credential Access Credential Access
Adversaries may exploit software vulnerabilities in an attempt to collect credentials.
Why these techniques?

Missing authentication in webapi component allows remote unauthenticated access to obtain admin credentials, directly enabling exploitation of public-facing application (T1190) for credential access (T1212).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References