VulnSocial

CVE-2024-10443Disclosure(synology / beephotos)

LOWCVSS 9.8 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft
  • Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in Task Manager component in Synology BeePhotos before 1.0.2-10026 and 1.1.0-10053 and Synology Photos before 1.6.2-0720 and 1.7.0-0795 allows remote attackers to execute arbitrary code via unspecified vectors.

synology CVEsBack to dashboard
2.0/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-78CWE-77

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • beephotos
  • beestation_os
  • diskstation_manager
  • photos

Threat summary

  • Public PoC is present in monitored signal
  • 1 mentions across 1 observed day

What's happening

  • PoC mentioned or linked in 1 signal
  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • 1 total mentions across 1 day

Affected systems

Vendors
synology
Products
beephotosbeestation_osdiskstation_managerphotos

4 versions affected across 4 products

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-03-27: 1PoC Mentioned / Linked · 2026-03-27: 1Technical Details · 2026-03-27: 103-27
Signal classification1 categories
Disclosure
1100.0%
Full discourse1 post
  • Germán Fernández@1ZRR4H
    Disclosure

    🔸 45[.]137[.]70[.]27:8080 #opendir 🔎 → CVE-2026-24061 (Telnetd Auth Bypass) → CVE-2024-3721 (TBK DVR Command Injection) → CVE-2024-10443 (Synology RCE via Crontab) https://t.co/ybGabCZnj3

    Post summary

    The tweet announces three CVEs with brief vulnerability descriptions and a link to further details, but does not provide exploit code, active exploitation evidence, or patch information.

    020095638.4K
    37.6K followersView on X
CPE platform detail6 entries

6 of 6 entries

PartVendorProductVersionTarget SWTarget HW
Appsynologybeephotos-beestation_os-
OSsynologybeestation_os1.0--
OSsynologybeestation_os1.1--
OSsynologydiskstation_manager7.2--
OSsynologydiskstation_manager7.2.2--
Appsynologyphotos-diskstation_manager-

Explore more

Back to dashboardsynology CVEsbeephotos vulnerabilities