| CVE ID | CVE-2024-39352 |
| CVSS SCORE | 6.8, AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
| AFFECTED VENDORS |
Synology |
| AFFECTED PRODUCTS |
BC500 |
| VULNERABILITY DETAILS |
This vulnerability allows network-adjacent attackers to downgrade Synology software on affected installations of Synology BC500 cameras. Authentication is required to exploit this vulnerability. The specific flaw exists within the update functionality. The issue results from the lack of proper validation of version information before performing an update. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. |
| ADDITIONAL DETAILS |
Synology has issued an update to correct this vulnerability. More details can be found at:
https://www.synology.com/en-id/security/advisory/Synology_SA_23_15 |
| DISCLOSURE TIMELINE |
|
| CREDIT | Romain JOUET (@JouetR), Baptiste MOINE (@Creased_) from Synacktiv (@Synacktiv) |
