PT-2024-28464 · Synology · Synology Camera Firmware

Published 2024-06-28 · Updated 2025-03-04 · CVE-2024-39349

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Synology Camera Firmware versions prior to 1.0.7-0298

Description A buffer copy issue without size checking, known as a 'Classic Buffer Overflow', exists in the libjansson component of the Synology Camera Firmware. This issue allows remote attackers to execute arbitrary code via unspecified vectors. The affected models include BC500 and TC500.

Recommendations For Synology Camera Firmware versions prior to 1.0.7-0298, update to version 1.0.7-0298 or later to resolve the issue. As a temporary workaround, consider restricting access to the synocam param.cgi endpoint until the update is applied.

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2024-39349

ZDI-24-833

Affected Products

Synology Camera Firmware

References · 7

• https://synology.com/en-global/security/advisory/Synology_SA_23_15 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-39349 · Security Note
• https://osv.dev/vulnerability/CVE-2024-39349 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-24-833 · Security Note
• https://t.me/cvenotify/113415 · Telegram Post
• https://t.me/pentestingnews/48874 · Telegram Post
• https://twitter.com/fletch_ai/status/1810584787595444648 · Twitter Post