CVE-2024-10443

Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in Task Manager component in Synology BeePhotos before 1.0.2-10026 and 1.1.0-10053 and Synology Photos before 1.6.2-0720 and 1.7.0-0795 allows remote attackers to execute arbitrary code via unspecified vectors.

Affected

Synology · BeePhotos · Synology Photos

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

28.01% chance of exploitation in the next 30 days, 98th percentile

Nuclei

critical · CWE-77

Published

2024-11-15

Updated

2025-09-16

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/code/cves/2024/CVE-2024-10443.yaml

Security advisories

• https://www.synology.com/en-global/security/advisory/Synology_SA_24_18
• https://www.synology.com/en-global/security/advisory/Synology_SA_24_19

References

• CVE Record
• NVD entry