PT-2023-32300 · Synology · Synology Camera Firmware

Chumen77 + 1 · Publicado 2023-10-24 · Atualizado 2023-11-02 · CVE-2023-5746

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Synology Camera Firmware versions prior to 1.0.5-0185

Description A vulnerability regarding the use of externally-controlled format string is found in the cgi component. This allows remote attackers to execute arbitrary code via unspecified vectors. The affected models include BC500 and TC500.

Recommendations For Synology Camera Firmware versions prior to 1.0.5-0185, update to version 1.0.5-0185 or later to resolve the issue. As a temporary workaround, consider restricting access to the cgi component until a patch is applied.

Correção

Use of Externally-Controlled Format String

Enumeração de Fraquezas

CWE-134

Identificadores relacionados

CVE-2023-5746

Produtos afetados

Synology Camera Firmware

Referências · 8

• https://t.me/pentestingnews/40457 · Publicação no Telegram
• https://t.me/cibsecurity/72873 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1716720709739614382 · Publicação no Twitter
• https://t.me/cvenotify/60412 · Publicação no Telegram
• https://synology.com/en-global/security/advisory/Synology_SA_23_11 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-5746 · Aviso do Fabricante
• https://twitter.com/samilaiho/status/1717033892505326040 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-5746 · Nota de Segurança