Vulnerability Description
A vulnerability regarding improper neutralization of special elements used in an OS command ('OS Command Injection') is found in the IP block functionality. This allows remote authenticated users with administrator privileges to execute arbitrary commands via unspecified vectors. The following models with Synology Camera Firmware versions before 1.0.7-0298 may be affected: BC500 and TC500.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Synology | Bc500 Firmware | < 1.0.7-0298 |
| Synology | Bc500 | - |
| Synology | Tc500 Firmware | < 1.0.7-0298 |
| Synology | Tc500 | - |
Related Weaknesses (CWE)
References
- https://www.synology.com/en-global/security/advisory/Synology_SA_23_15Vendor Advisory
- https://www.synology.com/en-global/security/advisory/Synology_SA_23_15Vendor Advisory
FAQ
What is CVE-2023-47802?
CVE-2023-47802 is a vulnerability with a CVSS score of 7.2 (HIGH). A vulnerability regarding improper neutralization of special elements used in an OS command ('OS Command Injection') is found in the IP block functionality. This allows remote authenticated users with...
How severe is CVE-2023-47802?
CVE-2023-47802 has been rated HIGH with a CVSS base score of 7.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-47802?
Check the references section above for vendor advisories and patch information. Affected products include: Synology Bc500 Firmware, Synology Bc500, Synology Tc500 Firmware, Synology Tc500.