CVE-2024-47273

Vulnerability

An improper limitation of a pathname to a restricted directory (Path Traversal) vulnerability exists in the Backup Task functionality of Synology Hyper Backup versions prior to 4.1.2-4036. This flaw allows for the overwriting of specific files.

Exploitation

An attacker must be a remote authenticated user with access to the Synology Hyper Backup application. The specific vectors for exploitation are not disclosed, but the vulnerability allows for the writing of specific files.

Impact

Successful exploitation of this vulnerability allows an authenticated attacker to write specific files to the system, potentially leading to system instability or unauthorized modifications depending on the targeted file.

Mitigation

Synology has released Hyper Backup version 4.1.2-4036, which addresses this vulnerability. Users are advised to update to this version or later. The release notes indicate a staged rollout for this version [1].