PT-2023-32300 · Synology · Synology Camera Firmware

Chumen77 + 1 · Published 2023-10-24 · Updated 2023-11-02 · CVE-2023-5746

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Synology Camera Firmware versions prior to 1.0.5-0185

Description A vulnerability regarding the use of externally-controlled format string is found in the cgi component. This allows remote attackers to execute arbitrary code via unspecified vectors. The affected models include BC500 and TC500.

Recommendations For Synology Camera Firmware versions prior to 1.0.5-0185, update to version 1.0.5-0185 or later to resolve the issue. As a temporary workaround, consider restricting access to the cgi component until a patch is applied.

Fix

Use of Externally-Controlled Format String

Weakness Enumeration

CWE-134

Related Identifiers

CVE-2023-5746

Affected Products

Synology Camera Firmware

References · 8

• https://synology.com/en-global/security/advisory/Synology_SA_23_11 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-5746 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-5746 · Security Note
• https://t.me/pentestingnews/40457 · Telegram Post
• https://t.me/cibsecurity/72873 · Telegram Post
• https://twitter.com/CVEnew/status/1716720709739614382 · Twitter Post
• https://t.me/cvenotify/60412 · Telegram Post
• https://twitter.com/samilaiho/status/1717033892505326040 · Twitter Post