CVE-2024-50631

CVE-2024-50631 is a SQL injection flaw (CWE-89) in the system syncing daemon of Synology Drive Server, allowing remote, unauthenticated attackers to inject SQL commands through unspecified vectors. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), exploitation requires no privileges or user interaction, and the impact is limited to write operations, so attackers can modify data in the underlying database but gain no read access or availability impact. Any organization or individual running an affected version of Synology Drive Server on a Synology NAS is exposed, particularly where the Drive service is reachable from the internet. As of now there is no known public proof-of-concept and the flaw is not in CISA's KEV catalog, but EPSS assigns a 26.2% probability of exploitation within 30 days (98th percentile), indicating a significant near-term risk.

What to do: Upgrade Synology Drive Server to 3.0.4-12699, 3.2.1-23280, 3.5.0-26085, or 3.5.1-26102 depending on your installed branch. Until patched, limit internet exposure of the Drive sync service (e.g., firewall it or require VPN access) and review for unexpected data modifications, since the flaw permits unauthorized writes.