PT-2024-28465 · Synology · Synology Camera Firmware

Published 2024-06-28 · Updated 2024-07-11 · CVE-2024-39350

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Synology Camera Firmware versions prior to 1.0.7-0298

Description A vulnerability in the RTSP functionality allows man-in-the-middle attackers to bypass authentication and obtain privileges without consent via unspecified vectors. This issue may be related to improper compartmentalization, potentially leading to local privilege escalation.

Recommendations For versions prior to 1.0.7-0298, update to version 1.0.7-0298 or later to resolve the issue. As a temporary workaround, consider restricting access to the RTSP functionality until a patch is applied.

Fix

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

CVE-2024-39350

ZDI-24-834

Affected Products

Synology Camera Firmware

References · 4

• https://synology.com/en-global/security/advisory/Synology_SA_23_15 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-39350 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-39350 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-24-834 · Security Note