CVE-2024-10444: Synology DSM Auth Bypass Vulnerability

CVE-2024-10444 Overview

CVE-2024-10444 is an improper certificate validation vulnerability [CWE-295] affecting the Lightweight Directory Access Protocol (LDAP) utilities in Synology DiskStation Manager (DSM). The flaw allows network-positioned attackers to intercept LDAP authentication traffic and hijack administrator sessions through man-in-the-middle (MITM) attacks. Synology assigned a CVSS 3.1 base score of 7.5 to this issue and tracks it under advisory Synology_SA_25_01. Affected DSM builds fail to properly validate the TLS certificate presented by the LDAP server, allowing forged or attacker-controlled certificates to be accepted during authentication. Exploitation requires user interaction but does not require prior privileges, making any administrator authenticating against a directory service a viable target.

Critical Impact
Successful MITM exploitation hijacks administrator authentication against the LDAP server, exposing credentials and granting attackers a path to full administrative compromise of the DSM appliance.

Affected Products

Synology DiskStation Manager (DSM) 7.1 builds before 7.1.1-42962-8
Synology DiskStation Manager (DSM) 7.2.1 builds before 7.2.1-69057-7
Synology DiskStation Manager (DSM) 7.2.2 builds before 7.2.2-72806-3

Discovery Timeline

2025-03-19 - CVE-2024-10444 published to the National Vulnerability Database (NVD)
2025-11-17 - CVE-2024-10444 record last modified in NVD

Technical Details for CVE-2024-10444

Vulnerability Analysis

The vulnerability resides in the LDAP utilities that DSM uses to authenticate users and administrators against an external directory service. These utilities establish a TLS-protected channel to the LDAP server but fail to fully validate the server certificate. An attacker able to intercept network traffic between the DSM appliance and the LDAP server can present a forged certificate that the client accepts. Once the TLS session is established under attacker control, the bind request — including administrator credentials — flows through the attacker's proxy. The attacker can then replay or directly reuse those credentials to authenticate against DSM with administrative privileges.

Root Cause

The root cause is improper certificate validation [CWE-295] in the LDAP client code path. Validation routines either skip verification of the certificate chain, accept self-signed or unrelated certificates, or fail to check that the certificate subject matches the configured LDAP server hostname. This breaks the trust assumptions of LDAPS and STARTTLS and converts an encrypted channel into one that is encrypted but not authenticated.

Attack Vector

The attack vector is network-based with high attack complexity and requires user interaction, typically an administrator initiating an authentication or directory operation. An attacker must hold a privileged network position between the DSM unit and the LDAP server, such as on the same VLAN, through ARP or DNS poisoning, or via a compromised upstream device. The attacker terminates the TLS session with a substituted certificate, captures the bind credentials, and either replays them or proxies the session to hijack the authenticated administrator context.

No public proof-of-concept exploit, ExploitDB entry, or CISA KEV listing is associated with CVE-2024-10444 at the time of writing. The EPSS probability remains low, reflecting limited observed exploitation activity. See the Synology Security Advisory SA-25-01 for vendor details.

Detection Methods for CVE-2024-10444

Indicators of Compromise

Unexpected administrator logins to DSM originating from sessions that followed an LDAP bind
LDAP server logs showing TLS sessions terminating at an IP address that is not the configured LDAP server
ARP table or DNS resolution anomalies on the network segment hosting the DSM appliance
Certificate fingerprints observed on the wire that do not match the issued LDAP server certificate

Detection Strategies

Inspect packet captures between DSM and LDAP servers for TLS handshakes presenting unexpected certificate subjects, issuers, or fingerprints
Correlate DSM administrator authentication events with directory server bind logs to identify mismatched source addresses or timing
Alert on new or untrusted Certificate Authorities appearing in TLS sessions on LDAP ports 389 (STARTTLS) and 636 (LDAPS)

Monitoring Recommendations

Enable verbose authentication logging on both DSM and the upstream LDAP directory and forward events to a centralized SIEM
Monitor for ARP spoofing, rogue DHCP, and DNS hijacking on the network segments that carry directory traffic
Track DSM firmware version and build identifiers across the fleet to confirm patched versions are deployed

How to Mitigate CVE-2024-10444

Immediate Actions Required

Upgrade DSM to a fixed build: 7.1.1-42962-8, 7.2.1-69057-7, or 7.2.2-72806-3 or later
Rotate credentials for any administrator accounts that have authenticated through the LDAP utility on a vulnerable build
Restrict management network access to DSM so that LDAP traffic traverses only trusted, segmented paths

Patch Information

Synology has released fixed firmware for the affected DSM branches. Refer to the Synology Security Advisory SA-25-01 for the authoritative list of fixed builds and download links. Apply the update through the DSM Control Panel under Update & Restore, or push the package centrally via Synology Central Management System for fleets.

Workarounds

Place DSM and the LDAP server on a dedicated, isolated VLAN to reduce opportunities for on-path interception
Enforce IPsec or another authenticated transport between DSM and the directory service until patching is complete
Where feasible, temporarily disable LDAP-based administrator authentication and use local accounts with strong credentials until the upgrade is applied

bash

# Verify the running DSM version contains the fix
cat /etc.defaults/VERSION | grep -E 'productversion|buildnumber|smallfixnumber'

# Expected fixed builds:
#   7.1.1-42962-8 or later
#   7.2.1-69057-7 or later
#   7.2.2-72806-3 or later