CVE-2024-29241: Critical severity Synology Surveillance Station vulnerability
Missing authorization vulnerability in System webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 allows remote authenticated users to obtain non-sensitive information, write sensitive configurations in DSM, and reboot or shutdown NAS via unspecified vectors.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-29241?
CVE-2024-29241 has been classified as a significant security vulnerability due to its potential to allow unauthorized access to sensitive features.
How do I fix CVE-2024-29241?
To fix CVE-2024-29241, update Synology Surveillance Station to version 9.2.0-9289 or later.
Who is affected by CVE-2024-29241?
CVE-2024-29241 affects users of Synology Surveillance Station versions earlier than 9.2.0-9289.
What components are vulnerable in CVE-2024-29241?
The missing authorization vulnerability in CVE-2024-29241 affects the System webapi component of Synology Surveillance Station.
Can remote users exploit CVE-2024-29241?
Yes, remote authenticated users can exploit CVE-2024-29241 to bypass security constraints on the affected systems.