Vulnerability Description
A vulnerability regarding improper neutralization of special elements used in an OS command ('OS Command Injection') is found in the NTP configuration. This allows remote authenticated users with administrator privileges to execute arbitrary commands via unspecified vectors. The following models with Synology Camera Firmware versions before 1.0.7-0298 may be affected: BC500 and TC500.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Synology | Bc500 Firmware | < 1.0.7-0298 |
| Synology | Bc500 | - |
| Synology | Tc500 Firmware | < 1.0.7-0298 |
| Synology | Tc500 | - |
Related Weaknesses (CWE)
References
- https://www.synology.com/en-global/security/advisory/Synology_SA_23_15Vendor Advisory
- https://www.synology.com/en-global/security/advisory/Synology_SA_23_15Vendor Advisory
FAQ
What is CVE-2024-39351?
CVE-2024-39351 is a vulnerability with a CVSS score of 7.2 (HIGH). A vulnerability regarding improper neutralization of special elements used in an OS command ('OS Command Injection') is found in the NTP configuration. This allows remote authenticated users with admi...
How severe is CVE-2024-39351?
CVE-2024-39351 has been rated HIGH with a CVSS base score of 7.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-39351?
Check the references section above for vendor advisories and patch information. Affected products include: Synology Bc500 Firmware, Synology Bc500, Synology Tc500 Firmware, Synology Tc500.