ZDI-CAN-22418: ZDI-24-833: (Pwn2Own) Synology BC500 synocam_param.cgi Stack-based Buffer Overflow Remote Code Execution Vulnerability

Published Jun 21, 2024

Updated

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Synology BC500 cameras. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2024-39349.

Affected Software

1 affected component

Synology BC500

Event History

Jun 21, 2024

Advisory Published

via ZDI·05:00 AM

Data Sourced

via ZDI·05:00 AM

Description

Frequently Asked Questions

What is the severity of ZDI-CAN-22418?

The severity of ZDI-CAN-22418 is rated at 8.8 on the CVSS scale.

How can I mitigate the ZDI-CAN-22418 vulnerability?

To mitigate the ZDI-CAN-22418 vulnerability, ensure that your Synology BC500 camera firmware is updated to the latest version provided by Synology.

Who is affected by the ZDI-CAN-22418 vulnerability?

The ZDI-CAN-22418 vulnerability affects installations of Synology BC500 cameras.

Is authentication required to exploit ZDI-CAN-22418?

No, authentication is not required to exploit the ZDI-CAN-22418 vulnerability.

What type of attack can exploit ZDI-CAN-22418?

Network-adjacent attackers can exploit ZDI-CAN-22418 to execute arbitrary code on affected installations.