CVE-2024-10441: Synology DSM and BeeStation OS Plugin Daemon Remote Code Execution

CVE-2024-10441 is a critical remote-code-execution vulnerability (CWE-116, improper encoding or escaping of output) in the system plugin daemon of Synology's DiskStation Manager (DSM) and BeeStation OS (BSM): it was disclosed at the Pwn2Own 2024 hacking competition and lets a remote attacker execute arbitrary code on an affected NAS via unspecified vectors, with Synology itself rating the flaw Critical and scoring it 9.8; NVD has not yet published its own Primary CVSS score.

CVE-2024-10441 (CWE-116, improper encoding or escaping of output) affects the system plugin daemon shared by Synology's DiskStation Manager (DSM) and BeeStation OS (BSM). NVD's description states: "Improper encoding or escaping of output vulnerability in the system plugin daemon in Synology BeeStation OS (BSM) before 1.1-65374 and Synology DiskStation Manager (DSM) before 7.2-64570-4, 7.2.1-69057-6 and 7.2.2-72806-1 allows remote attackers to execute arbitrary code via unspecified vectors" (NVD).

Synology's own advisory, Synology-SA-24:20, titled "DSM (PWN2OWN 2024)," rates the issue Critical and lists a wider set of affected DSM branches than NVD's description alone: DSM 7.2.2 (fixed in 7.2.2-72806-1), DSM 7.2.1 (fixed in 7.2.1-69057-6), DSM 7.2 (fixed in 7.2-64570-4), DSM 7.1 (fixed in 7.1.1-42962-7), and DSM 6.2 (fixed in 6.2.4-25556-8). The advisory credits the finding to Pumpkin Chang and Orange Tsai of the DEVCORE Research Team, Ryan Emmons, and Team Smoking Barrels — all participants at the Pwn2Own 2024 contest where the bug was demonstrated (Synology-SA-24:20).

NVD tracks CVE-2024-10441 with status "Analyzed" but records only Synology's own PSIRT-submitted score (source [email protected]) — CVSS v3.1 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — typed Secondary, not a Primary rating NVD has independently assigned itself, so this page does not show a headline severity score rather than presenting that figure as NVD-confirmed (NVD).

This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.01251 (69.6th percentile) as of 2026-11-07 (CISA KEV, FIRST EPSS).

NVD has not finished its own severity analysis. In the meantime, operators of affected Synology DSM or BeeStation devices should update to the fixed build listed in Synology-SA-24:20 for their specific DSM branch, since Synology itself treats the flaw as critical.

• Improper encoding or escaping of output in the system plugin daemon in Synology BeeStation OS before 1.1-65374 and DSM before 7.2-64570-4, 7.2.1-69057-6 and 7.2.2-72806-1 allows remote attackers to execute arbitrary code via unspecified vectors. — NVD
• Synology rates the issue Critical; fixed DSM branches are 7.2.2-72806-1, 7.2.1-69057-6, 7.2-64570-4, 7.1.1-42962-7 and 6.2.4-25556-8; disclosed at Pwn2Own 2024, credited to Pumpkin Chang and Orange Tsai (DEVCORE), Ryan Emmons, and Team Smoking Barrels. — Synology Security Advisory Synology-SA-24:20
• NVD status 'Analyzed' records only Synology's own Secondary CVSS v3.1 score of 9.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; no NVD-published Primary score as of this review. — NVD
• Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.01251 (69.6th percentile) as of 2026-11-07. — FIRST EPSS